Verbindungsabrüche bei verschiedenen Servicen

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Moussaoui (administrator) on MOUSSAOUI-PC on 25-01-2015 13:45:59
Running from F:\Downloads
Loaded Profiles: Moussaoui (Available profiles: Moussaoui)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Binary Fortress Software) E:\DisplayFusion\DisplayFusionService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
() E:\Rainmeter\Rainmeter.exe
() C:\ProgramData\gaupdt\service\0\gaupsvc.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\Windows\System32\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) E:\Teamviewer\TeamViewer_Service.exe
(Chris Pietschmann (hxxp://pietschsoft.com)) E:\VirtualRouter\VirtualRouterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Samsung Electronics.) E:\Samsung Magician\Samsung Magician.exe
(Piotr Pawlowski) E:\foobar2000\foobar2000.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
() C:\Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.232\deploy\LoLLauncher.exe
() C:\Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.16\deploy\LoLPatcher.exe
() C:\Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.126\deploy\LolClient.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(Mozilla Corporation) E:\Thunderbird\thunderbird.exe
(Mozilla Corporation) E:\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe
() F:\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7204568 2013-11-04] (Realtek Semiconductor)
HKLM\...\Run: [GamecomSound] => C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe [817440 2014-01-21] ()
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [478984 2012-12-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\RunOnce: [Adobe Speed Launcher] => 1422094966
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe ()
Startup: C:\Users\Moussaoui\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> E:\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?trackid=sp-006
HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://syb.msn.com
HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
SearchScopes: HKLM -> DefaultScope {9B4980B0-AA72-4EBC-BA28-63895BE9CB5E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {9B4980B0-AA72-4EBC-BA28-63895BE9CB5E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {9B4980B0-AA72-4EBC-BA28-63895BE9CB5E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1621062894-2451693253-3220061068-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1621062894-2451693253-3220061068-1000 -> {9B4980B0-AA72-4EBC-BA28-63895BE9CB5E} URL = 
SearchScopes: HKU\S-1-5-21-1621062894-2451693253-3220061068-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> E:\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> E:\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - E:\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{25338E54-3931-45FE-AC3A-C94BC9DD3569}: [NameServer] 8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF NetworkProxy: "autoconfig_url", "data:application/x-ns-proxy-autoconfig;base64,ZnVuY3Rpb24gaXNZb3VUdWJlVmlkZW8odXJsKXsgcmV0dXJuIG5ldyBSZWdFeHAoIl4oPzpodHRwfGh0dHBzKTpcXC9cXC8oPzouKikoPzouZ29vZ2xldmlkZW8uY29tfC5jLnlvdXR1YmUuY29tKSg/Oi4qKVxcL3ZpZGVvcGxheWJhY2soPzouKikoPzpnY3I9dXN8XFwvZ2NyXFwvdXNcXC8pKD86LiopJCIsJ2knKS50ZXN0KHVybCk7fWZ1bmN0aW9uIGlzWW91VHViZVZpZGVvUGFnZSh1cmwsIGhvc3QsIHZpZHVybCkgeyByZXR1cm4gaG9zdC5pbmRleE9mKCd5b3V0dWJlLmNvbScpICE9IC0xICYmIHVybC5pbmRleE9mKHZpZHVybCkgIT0gLTE7fWZ1bmN0aW9uIEZpbmRQcm94eUZvclVSTCh1cmwsIGhvc3QpIHtpZihpc1lvdVR1YmVWaWRlbyh1cmwpICB8fCBpc1lvdVR1YmVWaWRlb1BhZ2UodXJsLCBob3N0LCAnaHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/dj11N0s3Mlg0ZW9fcycpKXsgcmV0dXJuICdQUk9YWSAyMDkuMjM5LjExNC4yMDU6MzEzMSc7fWVsc2V7IHJldHVybiAnRElSRUNUJzt9fQ=="
FF NetworkProxy: "ftp", "64.31.22.131"
FF NetworkProxy: "ftp_port", 8089
FF NetworkProxy: "gopher", "64.31.22.131"
FF NetworkProxy: "gopher_port", 8089
FF NetworkProxy: "socks", "64.31.22.131"
FF NetworkProxy: "socks_port", 8089
FF NetworkProxy: "ssl", "64.31.22.131"
FF NetworkProxy: "ssl_port", 8089
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> E:\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> E:\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> E:\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect -> E:\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> E:\ITunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> E:\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> E:\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-1621062894-2451693253-3220061068-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Moussaoui\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Extension: United States English Spellchecker - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\en-US@dictionaries.addons.mozilla.org [2014-10-06]
FF Extension: Customize about:newtab - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\customizenewtab@alejandrobrizuela.com.ar.xpi [2014-11-24]
FF Extension: MEGA - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\firefox@mega.co.nz.xpi [2014-12-25]
FF Extension: ProxTube - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\ich@maltegoetz.de.xpi [2014-10-02]
FF Extension: BetterTTV - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\jid0-OeCFXKAPh2tC0bN3Li9ajRAZx6c@jetpack.xpi [2014-10-19]
FF Extension: Reddit Enhancement Suite - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2014-08-28]
FF Extension: Deutsch (DE) Language Pack - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-10-22]
FF Extension: SciLor's Grooveshark(tm) Unlocker for Germany - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\SciLorsGrooveUnlocker@scilor.com.xpi [2014-11-06]
FF Extension: Adblock Plus - C:\Users\Moussaoui\AppData\Roaming\Mozilla\Firefox\Profiles\d38pwc79.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-28]
StartMenuInternet: FIREFOX.EXE - E:\Mozilla Firefox\firefox.exe

Chrome: 
=======
CHR HomePage: Default -> 
CHR StartupUrls: Default -> ""
CHR Profile: C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-10-02]
CHR Extension: (BetterTTV) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2014-04-24]
CHR Extension: (Google Docs) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-13]
CHR Extension: (Google Drive) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-28]
CHR Extension: (YouTube) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-13]
CHR Extension: (Adblock Plus) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-21]
CHR Extension: (Google-Suche) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-13]
CHR Extension: (Hola Better Internet Engine) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbfmioobedknooiakdehepogalbgkng [2014-11-22]
CHR Extension: (Hola Besseres Internet) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2014-11-22]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2014-04-24]
CHR Extension: (Steam Theme) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcphcjcjgkjmbphkfjleamgkinaeebnm [2014-04-24]
CHR Extension: (Google Wallet) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-13]
CHR Extension: (Google Mail) - C:\Users\Moussaoui\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
R2 DisplayFusionService; E:\DisplayFusion\DisplayFusionService.exe [5278064 2014-09-09] (Binary Fortress Software)
R2 GaUpdateService; C:\ProgramData\gaupdt\service\0\gaupsvc.exe [1558032 2013-03-19] ()
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58387104 2014-07-12] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S3 Origin Client Service; D:\Origin\OriginClientService.exe [1903472 2014-12-31] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-08-09] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-08-08] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [765144 2014-11-28] (Secunia)
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [441504 2014-07-12] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; E:\Teamviewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
R2 Virtual Router; E:\VirtualRouter\VirtualRouterService.exe [12288 2013-02-10] (Chris Pietschmann (hxxp://pietschsoft.com)) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 A5AGU; C:\Windows\System32\DRIVERS\AGUx64.sys [1077760 2008-08-06] (D-Link Corporation)
R3 amdkmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [18963552 2012-06-27] (Advanced Micro Devices, Inc.) [File not signed]
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [36600 2014-08-19] (Riverbed Technology, Inc.)
R3 PlantronicsGC; C:\Windows\System32\drivers\PLTGC.sys [1328128 2013-02-07] (C-Media Electronics Inc)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)
R3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [1528976 2013-03-05] (Realtek Semiconductor Corporation                           )
R3 sshid; C:\Windows\System32\DRIVERS\sshid.sys [38912 2014-10-30] (SteelSeries ApS)
S3 cpuz134; \??\C:\Users\MOUSSA~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 GPU-Z; \??\C:\Users\MOUSSA~1\AppData\Local\Temp\GPU-Z.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S1 wStLibG64; system32\drivers\wStLibG64.sys [X]
U3 kwtciuow; \??\C:\Users\MOUSSA~1\AppData\Local\Temp\kwtciuow.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-25 13:45 - 2015-01-25 13:46 - 00000000 ____D () C:\FRST
2015-01-25 13:43 - 2015-01-25 13:43 - 00000000 _____ () C:\Users\Moussaoui\defogger_reenable
2015-01-24 10:54 - 2015-01-24 15:44 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-01-23 17:27 - 2015-01-23 17:27 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-23 16:07 - 2015-01-23 16:07 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\ATI
2015-01-23 16:07 - 2015-01-23 16:07 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\ATI
2015-01-23 16:07 - 2015-01-23 16:07 - 00000000 ____D () C:\ProgramData\ATI
2015-01-23 16:07 - 2015-01-23 16:07 - 00000000 _____ () C:\Windows\ativpsrm.bin
2015-01-23 16:05 - 2015-01-23 16:05 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2015-01-23 16:04 - 2015-01-23 16:04 - 00064312 _____ () C:\Windows\SysWOW64\CCCInstall_201501231604595491.log
2015-01-23 16:04 - 2015-01-23 16:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-01-23 16:04 - 2015-01-23 16:04 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2015-01-23 16:04 - 2015-01-23 16:04 - 00000000 ____D () C:\Program Files (x86)\AMD
2015-01-23 16:02 - 2015-01-23 16:02 - 00000000 ____D () C:\AMD
2015-01-23 11:02 - 2011-02-16 17:11 - 00428136 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2015-01-23 11:02 - 2011-02-16 17:11 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2015-01-23 11:02 - 2011-02-16 17:11 - 00074272 _____ () C:\Windows\system32\RtNicProp64.dll
2015-01-22 15:24 - 2015-01-22 15:24 - 00460680 _____ () C:\Windows\Minidump\012215-8626-01.dmp
2015-01-21 22:25 - 2015-01-21 22:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual Router
2015-01-20 19:30 - 2015-01-20 19:30 - 00000496 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\BitTorrent Sync.lnk
2015-01-19 19:47 - 2015-01-19 19:47 - 00000000 ____D () C:\NPE
2015-01-19 19:44 - 2015-01-23 15:56 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\NPE
2015-01-19 19:44 - 2015-01-19 19:44 - 00000000 ____D () C:\ProgramData\Norton
2015-01-18 19:53 - 2015-01-20 20:39 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\BitTorrent Sync
2015-01-17 20:15 - 2015-01-20 20:18 - 00005167 _____ () C:\Windows\system32\ScanResults.xml
2015-01-17 20:09 - 2015-01-20 20:16 - 00000464 _____ () C:\Windows\system32\ScannerSettings
2015-01-15 20:08 - 2015-01-17 20:20 - 00000165 _____ () C:\Windows\Reimage.ini
2015-01-15 16:23 - 2015-01-22 15:24 - 501084813 _____ () C:\Windows\MEMORY.DMP
2015-01-15 16:23 - 2015-01-15 16:23 - 00275888 _____ () C:\Windows\Minidump\011515-9703-01.dmp
2015-01-14 20:21 - 2015-01-14 20:21 - 00000529 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2015-01-14 18:21 - 2015-01-14 18:21 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nmap
2015-01-14 18:20 - 2015-01-14 18:20 - 00000000 ____D () C:\Program Files\WinPcap
2015-01-14 17:59 - 2015-01-14 17:59 - 00390776 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\TrufosAlt.sys
2015-01-14 17:56 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 17:56 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 17:56 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 17:56 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 17:56 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 17:56 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 17:56 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 17:56 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 17:56 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 17:56 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 17:56 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 17:56 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 17:56 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 16:30 - 2015-01-21 12:19 - 00003546 _____ () C:\Windows\PFRO.log
2015-01-13 09:47 - 2015-01-24 11:24 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-13 09:47 - 2015-01-13 09:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-13 09:47 - 2015-01-13 09:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-13 09:47 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-13 09:47 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-13 09:47 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-13 09:37 - 2015-01-14 16:02 - 00001092 _____ () C:\Windows\SecuniaPackage.log
2015-01-13 09:33 - 2015-01-13 09:33 - 00001073 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2015-01-13 09:33 - 2015-01-13 09:33 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\Secunia PSI
2015-01-13 09:33 - 2015-01-13 09:33 - 00000000 ____D () C:\Program Files (x86)\Secunia
2015-01-13 05:55 - 2015-01-13 13:31 - 00000000 ____D () C:\Program Files (x86)\stinger
2015-01-12 23:45 - 2015-01-12 23:46 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\CyberGhost
2015-01-12 23:45 - 2015-01-12 23:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberGhost 5
2015-01-12 23:45 - 2015-01-12 23:45 - 00000000 ____D () C:\Program Files\TAP-Windows
2015-01-12 23:45 - 2015-01-12 23:45 - 00000000 ____D () C:\Program Files\CyberGhost 5
2015-01-12 23:36 - 2015-01-12 23:36 - 00000600 _____ () C:\Users\Moussaoui\PUTTY.RND
2015-01-12 18:48 - 2015-01-12 18:48 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-12 18:48 - 2015-01-12 18:48 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-12 16:59 - 2015-01-24 11:22 - 00003539 _____ () C:\Windows\setupact.log
2015-01-12 16:59 - 2015-01-12 16:59 - 05066752 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-12 16:59 - 2015-01-12 16:59 - 00114976 _____ () C:\Users\Moussaoui\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-12 16:59 - 2015-01-12 16:59 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-11 14:26 - 2015-01-11 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Network Monitor 3.4
2015-01-11 00:15 - 2015-01-11 13:21 - 00000000 ____D () C:\ProgramData\TEMP
2015-01-11 00:15 - 2015-01-11 00:15 - 00001024 _____ () C:\.rnd
2015-01-11 00:15 - 2015-01-11 00:15 - 00000000 ____D () C:\ProgramData\Paessler
2015-01-11 00:15 - 2015-01-11 00:15 - 00000000 ____D () C:\ProgramData\Licenses
2015-01-06 02:53 - 2015-01-06 02:53 - 00000000 ____D () C:\ProgramData\VS
2015-01-06 02:50 - 2015-01-06 02:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-06 02:44 - 2011-09-22 21:07 - 00105832 _____ (Microsoft Corporation) C:\Windows\system32\SQSRVRES.DLL
2015-01-06 02:44 - 2011-09-22 21:06 - 00109416 _____ (Microsoft Corporation) C:\Windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.3.5500.0.dll
2015-01-06 02:44 - 2011-09-22 17:18 - 00073064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perf-MSSQL$SQLEXPRESS-sqlctr10.3.5500.0.dll
2015-01-06 02:43 - 2015-01-06 02:43 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 9.0
2015-01-06 02:40 - 2015-01-06 02:40 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2015-01-06 02:40 - 2015-01-06 02:40 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2015-01-06 02:17 - 2015-01-06 02:17 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-01-06 02:17 - 2015-01-06 02:17 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-01-06 02:17 - 2015-01-06 02:17 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2015-01-02 22:24 - 2015-01-02 23:26 - 00000000 ____D () C:\Program Files\Recuva
2015-01-02 18:34 - 2015-01-02 18:34 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\AAA_Internet_Publishing,_
2015-01-02 18:34 - 2014-10-15 14:18 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SPORDER.DLL
2015-01-02 16:56 - 2015-01-02 16:56 - 00000000 ____D () C:\ProgramData\TP-LINK
2015-01-02 16:56 - 2015-01-02 16:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK
2015-01-02 16:56 - 2013-03-05 14:14 - 01528976 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\rtwlanu.sys
2015-01-02 16:56 - 2013-03-05 14:14 - 01528976 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\Drivers\RTWlanU.sys
2015-01-02 16:56 - 2013-02-25 07:57 - 00007865 _____ () C:\Windows\system32\netrtwlanu.cat
2015-01-02 05:21 - 2015-01-25 01:52 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-02 05:03 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-01-02 05:03 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-01-02 05:03 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-01-02 05:03 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-01-02 05:03 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-01-02 05:03 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-01-02 05:03 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-01-02 05:03 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-01-02 05:03 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-01-02 05:03 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-01-01 03:52 - 2015-01-01 03:52 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\Introversion
2014-12-31 22:24 - 2014-12-31 22:24 - 00000000 ____D () C:\Program Files (x86)\Livestreamer
2014-12-27 18:37 - 2014-12-27 18:59 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\Ubisoft Game Launcher
2014-12-27 17:59 - 2014-12-27 18:08 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\Ubisoft
2014-12-27 17:47 - 2014-12-29 04:33 - 00000000 ____D () C:\ProgramData\BlueStacksSetup

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-25 13:45 - 2014-04-05 22:52 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\Skype
2015-01-25 13:45 - 2014-04-05 20:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-25 13:43 - 2014-04-05 19:53 - 00000000 ____D () C:\Users\Moussaoui
2015-01-25 13:04 - 2014-12-23 13:27 - 00000511 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-01-25 12:50 - 2014-04-13 09:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 11:38 - 2009-07-14 05:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-25 11:38 - 2009-07-14 05:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-25 11:34 - 2014-04-05 19:52 - 02041188 _____ () C:\Windows\WindowsUpdate.log
2015-01-25 08:50 - 2014-04-13 09:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-25 06:21 - 2014-11-30 14:33 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{5C497AA6-8DA4-4F51-9231-255D2BE41896}
2015-01-25 05:45 - 2014-04-05 20:42 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 05:45 - 2014-04-05 20:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 05:45 - 2014-04-05 20:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 02:00 - 2014-06-26 15:37 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\Adobe
2015-01-25 01:52 - 2014-04-11 15:36 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-25 01:52 - 2014-04-08 07:16 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-24 22:22 - 2014-07-07 07:25 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\CrashDumps
2015-01-24 22:22 - 2014-04-16 11:32 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\vlc
2015-01-24 11:36 - 2014-11-08 18:48 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\DisplayFusion
2015-01-24 11:27 - 2010-11-21 07:50 - 02603542 _____ () C:\Windows\system32\perfh007.dat
2015-01-24 11:27 - 2010-11-21 07:50 - 00749832 _____ () C:\Windows\system32\perfc007.dat
2015-01-24 11:27 - 2009-07-14 06:13 - 00006626 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-24 11:22 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-23 16:05 - 2014-05-08 00:56 - 00000000 ____D () C:\ProgramData\AMD
2015-01-23 16:04 - 2014-04-05 21:19 - 00000000 ____D () C:\Program Files\AMD
2015-01-23 15:33 - 2014-04-05 22:50 - 00000000 ____D () C:\Windows\pss
2015-01-23 11:02 - 2014-04-05 20:04 - 00001769 _____ () C:\Windows\Language_trs.ini
2015-01-23 11:02 - 2014-04-05 20:04 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-23 11:02 - 2014-04-05 20:04 - 00000000 ____D () C:\Program Files (x86)\Realtek
2015-01-22 19:37 - 2014-07-19 12:00 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\OBS
2015-01-22 15:24 - 2014-04-14 21:00 - 00000000 ____D () C:\Windows\Minidump
2015-01-18 19:37 - 2014-04-05 20:43 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\Adobe
2015-01-14 14:18 - 2014-04-15 18:39 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\Black_Tree_Gaming
2015-01-13 16:30 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-13 16:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help
2015-01-13 11:37 - 2014-04-09 04:43 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-01-13 11:14 - 2014-12-17 19:54 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\TeamViewer
2015-01-12 23:46 - 2014-04-05 19:53 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\VirtualStore
2015-01-12 23:43 - 2014-12-18 18:47 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\iFunbox_UserCache
2015-01-12 18:48 - 2011-04-07 09:21 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-06 23:04 - 2014-05-01 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft SQL Server 2008
2015-01-06 23:03 - 2014-05-01 09:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express
2015-01-06 23:03 - 2014-04-09 02:51 - 00000000 ____D () C:\Program Files\Microsoft SQL Server
2015-01-06 23:03 - 2014-04-09 02:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server
2015-01-06 02:57 - 2014-04-09 02:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-01-06 02:57 - 2014-04-08 14:03 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-06 02:55 - 2014-04-05 19:50 - 00114976 _____ () C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-06 02:55 - 2014-04-05 19:50 - 00114976 _____ () C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-06 02:47 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2015-01-06 02:17 - 2011-04-07 08:41 - 00001912 _____ () C:\Windows\epplauncher.mif
2015-01-05 03:00 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-04 06:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-03 22:57 - 2014-07-19 12:00 - 00000000 ____D () C:\Program Files\OBS
2015-01-02 05:21 - 2014-08-20 07:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-02 05:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-01-02 05:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-01-02 04:47 - 2014-04-05 21:35 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-01-01 15:12 - 2014-04-21 00:07 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\Battle.net
2015-01-01 14:59 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-12-31 23:23 - 2014-05-01 15:37 - 00007598 _____ () C:\Users\Moussaoui\AppData\Local\Resmon.ResmonCfg
2014-12-31 22:26 - 2014-07-23 20:34 - 00000000 ____D () C:\ProgramData\Origin
2014-12-31 22:24 - 2014-04-16 11:27 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\livestreamer
2014-12-31 13:12 - 2014-04-05 21:26 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-31 12:14 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-12-29 05:06 - 2014-04-10 09:33 - 00000000 ____D () C:\Users\Moussaoui\AppData\Local\SteelSeries Engine 3 Client
2014-12-29 04:34 - 2014-04-12 17:41 - 00000000 ____D () C:\Users\Moussaoui\AppData\Roaming\Notepad++
2014-12-29 04:33 - 2014-06-29 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StepMania 5
2014-12-29 04:33 - 2014-05-27 01:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCSOFT
2014-12-27 13:32 - 2014-10-20 07:59 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-27 13:32 - 2014-04-05 22:52 - 00000000 ____D () C:\ProgramData\Skype

==================== Files in the root of some directories =======

2014-12-18 20:25 - 2014-12-18 21:32 - 0000600 _____ () C:\Users\Moussaoui\AppData\Roaming\winscp.rnd
2014-12-18 21:02 - 2014-12-18 21:24 - 0000600 _____ () C:\Users\Moussaoui\AppData\Local\PUTTY.RND
2014-05-01 15:37 - 2014-12-31 23:23 - 0007598 _____ () C:\Users\Moussaoui\AppData\Local\Resmon.ResmonCfg
2014-04-07 02:58 - 2014-04-07 02:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Moussaoui\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Moussaoui\AppData\Local\Temp\namebench.exe
C:\Users\Moussaoui\AppData\Local\Temp\python27.dll
C:\Users\Moussaoui\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Moussaoui\AppData\Local\Temp\sqlite3.exe
C:\Users\Moussaoui\AppData\Local\Temp\tcl85.dll
C:\Users\Moussaoui\AppData\Local\Temp\tk85.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-24 04:40

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Moussaoui at 2015-01-25 13:46:23
Running from F:\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Disabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Illustrator CS6 (HKLM-x32\...\{4869414E-7AEA-4C8E-BE1C-8D40977FD517}) (Version: 16.0 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Anno 1404 (HKLM-x32\...\Steam App 33250) (Version:  - Blue Byte)
Anno 1404: Venice (HKLM-x32\...\Steam App 33350) (Version:  - Blue Byte)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BitTorrent Sync (HKLM-x32\...\BitTorrent Sync) (Version: 1.4.106 - BitTorrent Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version:  - Cheat Engine)
Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
Crysis 2 Maximum Edition (HKLM-x32\...\Steam App 108800) (Version:  - Crytek Studios)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DisplayFusion 6.1.2 (HKLM-x32\...\B076073A-5527-4f4f-B46B-B10692277DA2_is1) (Version: 6.1.2.0 - Binary Fortress Software)
Dragon Age Redesigned © Morrigan (HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\Dragon Age Redesigned © Morrigan) (Version:  - )
Dragon Age Redesigned© (HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\Dragon Age Redesigned©) (Version:  - )
Dragon Age Redesigned© Wynne (HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\Dragon Age Redesigned© Wynne) (Version:  - )
Dragon Age: Origins - Ultimate Edition (HKLM-x32\...\Steam App 47810) (Version:  - BioWare)
Dragon Age: Origins (HKLM-x32\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.05.0.0 - Electronic Arts)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Free Alarm Clock 3.1.0 (HKLM-x32\...\{8ED5A2F1-338F-4608-8AF7-BCD1ADC1E1F7}_is1) (Version: 3.1 - Comfort Software Group)
GDR 5520 für SQL Server 2008 (KB 2977321) (64-bit) (HKLM\...\KB2977321) (Version: 10.3.5520.0 - Microsoft Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Hotfix für Microsoft Visual C++ 2010 Express - DEU (KB2635973) (HKLM-x32\...\{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}.KB2635973) (Version: 1 - Microsoft Corporation)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
iFunbox (v2.6.2375.747), iFunbox DevTeam (HKLM-x32\...\iFunbox_is1) (Version: v2.6.2375.747 - )
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Livestreamer 1.11.1 (HKLM-x32\...\Livestreamer) (Version:  - )
LOOT (HKLM-x32\...\LOOT) (Version: 0.6.0 - LOOT Development Team)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 1.1 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.1 Language Pack - DEU) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Network Monitor 3.4 (HKLM\...\{8C5B5A11-CBF8-451B-B201-77FAB0D0B77D}) (Version: 3.4.2350.0 - Microsoft Corporation)
Microsoft Network Monitor: NetworkMonitor Parsers 3.4 (HKLM\...\{963E5FEB-1367-46B9-851D-A957F1A3747F}) (Version: 3.4.2350.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 (64-bit) (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 Browser (HKLM-x32\...\{4AF2248C-B3DF-46FB-9596-87F5DB193689}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{12FE6AA6-65D2-40EE-B925-62193128A0E6}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files  (HKLM\...\{393CA5BF-0362-42FD-ABC2-BA9D22EF925E}) (Version: 10.3.5520.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{28D06854-572C-4A65-83E5-F8CAF26B9FDC}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM-x32\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.40219 (HKLM\...\{1C7C8AAF-A16D-32E8-89E5-F6D165DE0BCE}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (HKLM-x32\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 Express - DEU (HKLM-x32\...\Microsoft Visual C++ 2010 Express - DEU) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (HKLM-x32\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Mortal Kombat Komplete Edition (HKLM-x32\...\Steam App 237110) (Version:  - NetherRealm Studios)
Mount&Blade Warband (HKLM-x32\...\Mount&Blade Warband) (Version:  - )
Mozilla Firefox 33.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 de)) (Version: 33.0 - Mozilla)
Mozilla Firefox 35.0 (x86 de) (HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\Mozilla Firefox 35.0 (x86 de)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.1.2 - Mozilla)
Mozilla Thunderbird 31.1.2 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.1.2 (x86 de)) (Version: 31.1.2 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSI Afterburner 4.0.0 (HKLM-x32\...\Afterburner) (Version: 4.0.0 - MSI Co., LTD)
Need for Speed™ SHIFT (HKLM-x32\...\{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}) (Version: 1.0.0.0 - Electronic Arts)
Nmap 6.47 (HKLM-x32\...\Nmap) (Version:  - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
NVIDIA PhysX (HKLM-x32\...\{5DB65884-C963-4454-AABA-4CA3089281FA}) (Version: 9.09.0720 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 9.4.11.2806 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Plantronics® GameCom 780/788 Software for Dolby® Headphone (HKLM-x32\...\{EB3C9064-9140-4279-9E51-965119402151}) (Version: 3.20.0001 - Plantronics)
puush (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284B}) (Version: 1.0.0.0 - Dean Herbert)
Rainmeter (HKLM-x32\...\Rainmeter) (Version: 3.2 beta r2326 - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.41.216.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.5.1 - Samsung Electronics)
Secunia PSI (3.0.0.10004) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.10004 - Secunia)
Service Pack 3 für SQL Server 2008 (KB2546951) (64-bit) (HKLM\...\KB2546951) (Version: 10.3.5500.0 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sonic & All-Stars Racing Transformed (HKLM-x32\...\Steam App 212480) (Version:  - Sumo Digital)
Source Filmmaker (HKLM-x32\...\Steam App 1840) (Version:  - Valve)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0 - Microsoft Corporation) Hidden
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
SteelSeries Engine 3.3.1 (HKLM\...\SteelSeries Engine 3) (Version: 3.3.1 - SteelSeries ApS)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36897 - TeamViewer)
TP-LINK TL-WN725N_TL-WN723N Treiber (HKLM-x32\...\{3C3F9CEB-2C5A-4A47-8EAA-DA76037546BA}) (Version: 1.3.1 - TP-LINK)
Unity Web Player (HKU\S-1-5-21-1621062894-2451693253-3220061068-1000\...\UnityWebPlayer) (Version: 4.5.1f3 - Unity Technologies ApS)
Virtual Router v1.0 (HKLM-x32\...\{BE905C46-2B34-4D73-AEE1-769ED138E0FF}) (Version: 1.0 - Chris Pietschmann)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - CACE Technologies)
WinRAR 5.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
Wireshark 1.12.3 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.3 - The Wireshark developer community, hxxp://www.wireshark.org)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1621062894-2451693253-3220061068-1000_Classes\CLSID\{077f9ad2-15a7-445e-a33a-e21809138189}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1621062894-2451693253-3220061068-1000_Classes\CLSID\{AB246BE9-1623-4A84-ABDA-CFF4D4A273CB}\InprocServer32 -> C:\Windows\system32\kernel32.dll (Microsoft Corporation)

==================== Restore Points  =========================

ATTENTION: System Restore is disabled.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-04-09 05:25 - 00001827 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 hl2rcv.adobe.com
127.0.0.1 209.34.83.73:443
127.0.0.1 209.34.83.73:43
127.0.0.1 209.34.83.73
127.0.0.1 209.34.83.67:443
127.0.0.1 209.34.83.67:43
127.0.0.1 209.34.83.67
127.0.0.1 ood.opsource.net
127.0.0.1 CRL.VERISIGN.NET
127.0.0.1 199.7.52.190:80

There are 4 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0A86C16B-F7D5-42C4-B181-2AC7322D4B1C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => E:\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {69BDBC84-E1CF-43FA-AB37-9296F3B72FE1} - System32\Tasks\SamsungMagician => E:\Samsung Magician\Samsung Magician.exe [2014-09-28] (Samsung Electronics.)
Task: {7D308554-CD75-497C-A416-791C550C2188} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {9757F5D9-CCDA-4F81-8807-0D80FD874343} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => E:\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {9FE829BA-D753-403D-AA46-AC3BA9EF0364} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-13] (Google Inc.)
Task: {A6685FFD-5DA2-4A2C-A5C3-44A466A19449} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {AE2C019F-FBD3-427C-A221-D11070A5374D} - System32\Tasks\CCleanerSkipUAC => E:\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {B088DC82-D36E-4DF9-99D3-825CF2537A6F} - System32\Tasks\AdobeAAMUpdater-1.0-Moussaoui-PC-Moussaoui => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-12-15] (Adobe Systems Incorporated)
Task: {D371A330-50BB-4484-9E3F-13D3FA881555} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
Task: {DE108908-9D87-4834-9B1A-7C8C9401C19D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-13] (Google Inc.)
Task: {E8ECAD8E-8D36-4A8B-8F8F-7FFEE6FD8276} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2014-12-01] (Apple Inc.)
Task: {ED37AB3D-A50B-4573-819D-767FDD2940EA} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2015-01-20 19:30 - 2015-01-20 19:30 - 00102912 _____ () E:\BT\SyncShellContextMenu.dll
2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () E:\Notepad++\NppShell_05.dll
2014-11-20 21:23 - 2014-11-20 21:23 - 00214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 00817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 06:08 - 2014-02-11 06:08 - 03650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2014-11-20 21:23 - 2014-11-20 21:23 - 00127488 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-04-12 20:23 - 2014-01-21 15:40 - 00817440 ____N () C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe
2014-11-13 22:19 - 2014-11-13 22:19 - 17542656 _____ () C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
2014-10-14 15:10 - 2014-10-14 15:10 - 00047616 _____ () C:\Program Files\SteelSeries\SteelSeries Engine 3\x2api.dll
2014-09-17 14:13 - 2014-09-17 14:13 - 00036536 _____ () E:\Rainmeter\Rainmeter.exe
2014-09-17 14:13 - 2014-09-17 14:13 - 00752312 _____ () E:\Rainmeter\Rainmeter.dll
2014-09-17 14:12 - 2014-09-17 14:12 - 00056832 _____ () E:\Rainmeter\Plugins\WebParser.dll
2014-07-06 06:09 - 2013-03-19 12:05 - 01558032 _____ () C:\ProgramData\gaupdt\service\0\gaupsvc.exe
2014-11-20 21:23 - 2014-11-20 21:23 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-08-09 16:12 - 2014-08-09 16:12 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe
2014-01-21 16:54 - 2014-12-21 18:54 - 01294336 _____ () C:\Games\League of Legends\RADS\system\rads_user_kernel.exe
2014-12-21 18:54 - 2015-01-15 18:36 - 02436600 _____ () C:\Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.232\deploy\LoLLauncher.exe
2015-01-15 18:36 - 2015-01-15 18:36 - 04113400 _____ () C:\Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.16\deploy\LoLPatcher.exe
2014-12-21 18:56 - 2014-12-21 18:56 - 00074752 _____ () C:\Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.126\deploy\LolClient.exe
2015-01-25 13:42 - 2015-01-25 13:42 - 00050477 _____ () F:\Downloads\Defogger.exe
2014-10-11 13:06 - 2014-10-11 13:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-04-12 20:23 - 2014-01-21 15:40 - 00149792 ____N () C:\Program Files\Plantronics\GameCom 780 & 788\VmixPLGC.dll
2014-07-06 06:09 - 2012-08-01 10:42 - 00156160 _____ () C:\ProgramData\gaupdt\service\0\libzmq.dll
2014-07-06 06:09 - 2013-02-22 03:08 - 00454656 _____ () C:\ProgramData\gaupdt\service\0\archive.dll
2014-04-05 22:31 - 2014-09-28 17:59 - 00019872 _____ () E:\Samsung Magician\SAMSUNG_SSD.dll
2013-05-04 12:57 - 2013-05-04 12:57 - 00095712 _____ () E:\foobar2000\zlib1.dll
2014-04-11 10:51 - 2014-04-11 10:51 - 00156624 _____ () E:\foobar2000\shared.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00199168 _____ () E:\foobar2000\components\foo_dsp_eq.dll
2014-04-11 10:51 - 2014-04-11 10:51 - 00945128 _____ () E:\foobar2000\components\foo_ui_std.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00199680 _____ () E:\foobar2000\components\foo_dsp_std.dll
2014-06-26 20:41 - 2011-05-29 10:26 - 00334848 _____ () E:\foobar2000\components\foo_quicksearch.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00285696 _____ () E:\foobar2000\components\foo_fileops.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00299520 _____ () E:\foobar2000\components\foo_freedb2.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00304640 _____ () E:\foobar2000\components\foo_cdda.dll
2014-06-26 20:41 - 2011-07-24 18:08 - 00271872 _____ () E:\foobar2000\components\foo_uie_library_tree.dll
2014-06-26 20:41 - 2012-10-16 07:45 - 00946176 _____ () E:\foobar2000\components\foo_uie_wsh_panel_mod.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00501248 _____ () E:\foobar2000\components\foo_converter.dll
2014-06-26 20:41 - 2010-10-30 20:51 - 00452608 _____ () E:\foobar2000\components\foo_uie_elplaylist.dll
2014-06-26 20:41 - 2012-06-15 16:59 - 00802816 _____ () E:\foobar2000\components\foo_uie_lyrics3.dll
2014-06-26 20:41 - 2010-12-11 08:47 - 00337920 _____ () E:\foobar2000\components\foo_uie_biography.dll
2014-04-11 10:51 - 2014-04-11 10:51 - 01391080 _____ () E:\foobar2000\components\foo_input_std.dll
2014-04-11 10:48 - 2014-04-11 10:48 - 00173056 _____ () E:\foobar2000\components\foo_unpack.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00353280 _____ () E:\foobar2000\components\foo_rgscan.dll
2014-06-26 20:41 - 2009-12-10 00:16 - 00356352 _____ () E:\foobar2000\components\foo_uie_panel_splitter.dll
2014-06-26 20:41 - 2011-07-13 10:47 - 00230912 _____ () E:\foobar2000\components\foo_playcount.dll
2014-06-26 20:41 - 2009-09-28 10:32 - 00242176 _____ () E:\foobar2000\components\foo_vis_shpeck.dll
2014-06-26 20:41 - 2011-02-27 22:22 - 01608192 _____ () E:\foobar2000\components\foo_ui_columns.dll
2014-04-11 10:49 - 2014-04-11 10:49 - 00350720 _____ () E:\foobar2000\components\foo_albumlist.dll
2014-06-26 20:41 - 2012-12-24 03:42 - 00241664 _____ () E:\foobar2000\components\foo_ui_hacks.dll
2015-01-15 18:36 - 2015-01-15 18:36 - 01617400 _____ () C:\Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.16\deploy\RiotLauncher.dll
2014-12-21 18:55 - 2014-12-21 18:55 - 04774248 _____ () C:\Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.126\deploy\Adobe AIR\Versions\1.0\Resources\WebKit.dll
2014-12-21 18:55 - 2014-12-21 18:55 - 16032616 _____ () C:\Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.126\deploy\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll
2015-01-13 17:07 - 2015-01-13 17:07 - 03925104 _____ () E:\Mozilla Firefox\mozjs.dll
2015-01-14 18:56 - 2015-01-14 18:56 - 03347056 _____ () E:\Thunderbird\mozjs.dll
2015-01-14 18:56 - 2015-01-14 18:56 - 00158832 _____ () E:\Thunderbird\NSLDAP32V60.dll
2015-01-14 18:56 - 2015-01-14 18:56 - 00023152 _____ () E:\Thunderbird\NSLDAPPR32V60.dll
2015-01-25 05:45 - 2015-01-25 05:45 - 16844976 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:9A870F8B

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Secunia PSI Tray.lnk => C:\Windows\pss\Secunia PSI Tray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Virtual Router Manager.lnk => C:\Windows\pss\Virtual Router Manager.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Moussaoui^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Samsung Magician.lnk => C:\Windows\pss\Samsung Magician.lnk.Startup
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: CCleaner Monitoring => "E:\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: CyberGhost => "C:\Program Files\CyberGhost 5\CyberGhost.EXE" /autostart
MSCONFIG\startupreg: DAEMON Tools Lite => "E:\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: FreeAC => E:\FreeAlarmClock\FreeAlarmClock.exe -autorun
MSCONFIG\startupreg: GoogleChromeAutoLaunch_EBB30A86BE3F353108A4E918AEE1F548 => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: iTunesHelper => "E:\ITunes\iTunesHelper.exe"
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "E:\Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: Raptr => C:\PROGRA~2\Raptr\raptrstub.exe --startup
MSCONFIG\startupreg: Spotify => "C:\Users\Moussaoui\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Moussaoui\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
MSCONFIG\startupreg: VirtualCloneDrive => "E:\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: WTFast Tray => "E:\WTFast\WTFast.exe" trayonly

========================= Accounts: ==========================

Administrator (S-1-5-21-1621062894-2451693253-3220061068-500 - Administrator - Disabled)
Gast (S-1-5-21-1621062894-2451693253-3220061068-501 - Limited - Disabled)
Moussaoui (S-1-5-21-1621062894-2451693253-3220061068-1000 - Administrator - Enabled) => C:\Users\Moussaoui

==================== Faulty Device Manager Devices =============

Name: TeamViewer VPN Adapter
Description: TeamViewer VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TeamViewer GmbH
Service: teamviewervpn
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: TAP-Windows Adapter V9
Description: TAP-Windows Adapter V9
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Windows Provider V9
Service: tap0901
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: wStLibG64
Description: wStLibG64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: wStLibG64
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/25/2015 00:30:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 162c

Startzeit: 01d0389259a0448c

Endzeit: 2

Anwendungspfad: C:\Games\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: 9bf1724d-a485-11e4-b8d2-5404a6b5cce5

Error: (01/25/2015 04:16:17 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/24/2015 10:22:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.5.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000018e5d
ID des fehlerhaften Prozesses: 0x16d4
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3

Error: (01/24/2015 05:14:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.1.5.0, Zeitstempel: 0x00000000
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000018e5d
ID des fehlerhaften Prozesses: 0x19d0
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3

Error: (01/24/2015 11:26:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/24/2015 11:26:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/24/2015 11:26:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/24/2015 11:24:35 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/24/2015 11:06:20 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/24/2015 11:06:20 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (01/25/2015 07:50:57 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (01/25/2015 05:45:14 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (01/25/2015 03:23:28 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (01/24/2015 00:39:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (01/24/2015 00:39:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (01/24/2015 11:24:22 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (01/24/2015 11:24:10 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
wStLibG64

Error: (01/24/2015 11:24:10 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "VirtualRouterService" wurde nicht richtig gestartet.

Error: (01/24/2015 11:22:45 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\system32\Rtlihvs.dll
Fehlercode: 126

Error: (01/24/2015 11:12:19 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0


Microsoft Office Sessions:
=========================
Error: (01/25/2015 00:30:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rads_user_kernel.exe0.0.0.0162c01d0389259a0448c2C:\Games\League of Legends\RADS\system\rads_user_kernel.exe9bf1724d-a485-11e4-b8d2-5404a6b5cce5

Error: (01/25/2015 04:16:17 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifeste:\CCleaner\CCleaner.exe

Error: (01/24/2015 10:22:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18247521eaf24c00000050000000000018e5d16d401d03817464181bdE:\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll19f7dede-a40f-11e4-b8d2-5404a6b5cce5

Error: (01/24/2015 05:14:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.1.5.000000000ntdll.dll6.1.7601.18247521eaf24c00000050000000000018e5d19d001d037e965fbeb07E:\VLC\vlc.exeC:\Windows\SYSTEM32\ntdll.dll071cc993-a3e4-11e4-b8d2-5404a6b5cce5

Error: (01/24/2015 11:26:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/24/2015 11:26:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/24/2015 11:26:59 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/24/2015 11:24:35 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/24/2015 11:06:20 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/24/2015 11:06:20 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


==================== Memory info =========================== 

Processor: AMD FX(tm)-8120 Eight-Core Processor 
Percentage of memory in use: 49%
Total physical RAM: 8191.1 MB
Available physical RAM: 4108.81 MB
Total Pagefile: 9213.28 MB
Available Pagefile: 4700 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.79 GB) (Free:31.22 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Games) (Fixed) (Total:390.62 GB) (Free:278.19 GB) NTFS
Drive e: (Programs) (Fixed) (Total:244.14 GB) (Free:206.28 GB) NTFS
Drive f: (Media) (Fixed) (Total:296.74 GB) (Free:141.68 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 91ED5CA2)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: ED7A8D49)
Partition 1: (Not Active) - (Size=390.6 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=244.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=296.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-25 14:03:09
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a Samsung_ rev.EXT0 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\MOUSSA~1\AppData\Local\Temp\kwtciuow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 586                                                                          fffff8000200008a 7 bytes [00, 00, 00, 00, 00, 00, 03]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594                                                                          fffff80002000092 4 bytes [00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\PnkBstrA.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                              0000000074cb1465 2 bytes [CB, 74]
.text     C:\Windows\system32\PnkBstrA.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                             0000000074cb14bb 2 bytes [CB, 74]
.text     ...                                                                                                                                         * 2
.text     C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000074cb1465 2 bytes [CB, 74]
.text     C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  0000000074cb14bb 2 bytes [CB, 74]
.text     ...                                                                                                                                         * 2
.text     E:\Teamviewer\TeamViewer_Service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000074cb1465 2 bytes [CB, 74]
.text     E:\Teamviewer\TeamViewer_Service.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         0000000074cb14bb 2 bytes [CB, 74]
.text     ...                                                                                                                                         * 2
.text     C:\Program Files\CyberGhost 5\Service.exe[1048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                     0000000074cb1465 2 bytes [CB, 74]
.text     C:\Program Files\CyberGhost 5\Service.exe[1048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    0000000074cb14bb 2 bytes [CB, 74]
.text     ...                                                                                                                                         * 2
.text     C:\Program Files (x86)\Secunia\PSI\sua.exe[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                    0000000074cb1465 2 bytes [CB, 74]
.text     C:\Program Files (x86)\Secunia\PSI\sua.exe[4352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                   0000000074cb14bb 2 bytes [CB, 74]
.text     ...                                                                                                                                         * 2
?         C:\Windows\system32\mssprxy.dll [6196] entry point in ".rdata" section                                                                      000000005eab71e6
.text     F:\Downloads\Defogger.exe[7664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000074cb1465 2 bytes [CB, 74]
.text     F:\Downloads\Defogger.exe[7664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    0000000074cb14bb 2 bytes [CB, 74]
.text     ...                                                                                                                                         * 2
---- Processes - GMER 2.1 ----

Library   C:\ProgramData\gaupdt\service\0\libzmq.dll (*** suspicious ***) @ C:\ProgramData\gaupdt\service\0\gaupsvc.exe [2468](2014-07-06 05:09:40)   00000000707b0000
Library   C:\ProgramData\gaupdt\service\0\archive.dll (*** suspicious ***) @ C:\ProgramData\gaupdt\service\0\gaupsvc.exe [2468](2014-07-06 05:09:40)  0000000070220000

---- Files - GMER 2.1 ----

File      C:\Program Files (x86)\Secunia\PSI\SUA\running                                                                                              0 bytes

---- EOF - GMER 2.1 ----