Windows 8.1: Befall von GVU Trojaner, abgesicherter Modus funktioniert

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:39 on 31/01/2015 (Markus)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-01-2015 01
Ran by Markus (administrator) on MARKUSLAPTOP on 31-01-2015 21:41:01
Running from C:\Users\Markus\Desktop
Loaded Profiles: Markus (Available profiles: UpdatusUser & Markus & Administrator & Gast)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Safe Mode (minimal)
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2864016 2012-08-10] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe
HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe
HKLM-x32\...\Run: [BakupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [533568 2012-08-22] (NTI Corporation)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2995904 2012-07-11] (Symantec Corporation)
HKLM-x32\...\Run: [QuickTime Task] => c:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\Run: [Macrovision Security Driver] => C:\Users\Markus\AppData\Roaming\Microsoft\LookupSvi.exe [7168 2015-01-31] ()
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\CurrentVersion\Windows: [Load] C:\Users\Markus\LOCALS~1\Temp\msuxzb.exe <===== ATTENTION
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\MountPoints2: {cafb5d96-717b-11e3-beb8-b888e3bef697} - "E:\SETUP.EXE" 
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\Winlogon: [Userinit] C:\Users\Markus\AppData\Roaming\loadit.exe [605048 2015-01-31] ()
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\Winlogon: [Shell] C:\Users\Markus\AppData\Roaming\loadit.exe [605048 2015-01-31] () <==== ATTENTION 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs:  C:\PROGRA~2\WS-BOO~1\ASSIST~2.DLL => C:\Program Files (x86)\WS-Booster\Assistant_x64.dll [4383232 2014-02-28] ()
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk
ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoStarter.lnk
ShortcutTarget: AutoStarter.lnk -> C:\Users\Markus\AppData\Roaming\autostarter.exe ()
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe (Microsoft Installer - Startup)
Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ja.lnk
ShortcutTarget: ja.lnk -> C:\Users\Markus\AppData\Roaming\loadit.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default
FF Homepage: hxxp://www.spiegel.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Extension: Blur (Formerly DoNotTrackMe) - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\donottrackplus@abine.com [2014-11-21]
FF Extension: ColorZilla - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2015-01-29]
FF Extension: Firebug - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\firebug@software.joehewitt.com.xpi [2015-01-29]
FF Extension: FireGestures - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\firegestures@xuldev.org.xpi [2014-02-28]
FF Extension: ProxTube - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\ich@maltegoetz.de.xpi [2014-09-12]
FF Extension: InstantFox - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\searchy@searchy.xpi [2014-02-28]
FF Extension: FlashGot - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-02-28]
FF Extension: Adblock Plus - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\zyhnos37.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-28]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-09-11]
FF HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-07-15]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (NextCCouup) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\clleekmdaehljcdgellilekkkogohaok [2014-02-28]
CHR Extension: (Block Seen in Facebook) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlekddgkpaddbgbpikkfodhjfjjmomgf [2014-02-28]
CHR Extension: (SiteAdvisor) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-02-28]
CHR Extension: (AdBlock Premium) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\fndlhnanhedoklpdaacidomdnplcjcpj [2014-02-28]
CHR Extension: (saave  on) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lojlbmimpnhndjmeigpappkhfjdhkogh [2014-07-01]
CHR Extension: (Google Wallet) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-27]
CHR Extension: (Citavi Picker) - C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-02-28]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-07-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-22] (Acer Incorporated)
S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S2 NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [5352960 2011-03-09] (Native Instruments GmbH) [File not signed]
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3939008 2012-07-11] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-22] (NTI Corporation)
S2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2013-09-13] (arvato digital services llc)
S2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-09-10] (Dritek System INC.)
S2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390672 2012-08-08] ()
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [558592 2013-10-20] () [File not signed]
S2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00A\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-11-17] (Disc Soft Ltd)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-09-10] (Dritek System Inc.)
S1 UimBus; C:\Windows\System32\drivers\UimBus.sys [102664 2014-01-23] ()
S1 Uim_DEVIM; C:\Windows\System32\drivers\uim_devim.sys [25992 2014-01-23] ()
S1 Uim_IM; C:\Windows\System32\drivers\uim_im.sys [700680 2014-01-23] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-31 21:41 - 2015-01-31 21:41 - 00015528 _____ () C:\Users\Markus\Desktop\FRST.txt
2015-01-31 21:40 - 2015-01-31 21:41 - 00000000 ____D () C:\FRST
2015-01-31 21:39 - 2015-01-31 21:39 - 00000544 _____ () C:\Users\Markus\Desktop\defogger_disable.log
2015-01-31 21:39 - 2015-01-31 21:39 - 00000168 _____ () C:\Users\Markus\defogger_reenable
2015-01-31 21:39 - 2015-01-31 21:36 - 00380416 _____ () C:\Users\Markus\Desktop\7p0klsg6.exe
2015-01-31 21:39 - 2015-01-31 21:35 - 02130944 _____ (Farbar) C:\Users\Markus\Desktop\FRST64.exe
2015-01-31 21:39 - 2015-01-31 21:32 - 00050477 _____ () C:\Users\Markus\Desktop\Defogger.exe
2015-01-31 20:13 - 2015-01-31 20:13 - 00000000 ___HD () C:\$SysReset
2015-01-31 19:39 - 2015-01-31 19:39 - 00605048 _____ () C:\Users\Markus\AppData\Roaming\loadit.exe
2015-01-31 19:39 - 2015-01-31 19:39 - 00000032 _____ () C:\Users\Markus\AppData\Roaming\url.txt
2015-01-31 19:38 - 2015-01-31 19:38 - 00001817 _____ () C:\Users\Public\Desktop\TimePanic.lnk
2015-01-31 19:38 - 2015-01-31 19:38 - 00000000 __SHD () C:\WINDOWS\SysWOW64\AI_RecycleBin
2015-01-31 19:38 - 2015-01-31 19:38 - 00000000 ____D () C:\Users\Public\Documents\TimePanic
2015-01-31 19:38 - 2015-01-31 19:38 - 00000000 ____D () C:\Users\Markus\Documents\TimePanic
2015-01-31 19:38 - 2015-01-31 19:38 - 00000000 ____D () C:\Users\Markus\AppData\Local\TimePanic
2015-01-31 19:38 - 2015-01-31 19:38 - 00000000 ____D () C:\ProgramData\TimePanic
2015-01-31 19:38 - 2015-01-31 19:38 - 00000000 ____D () C:\Program Files (x86)\TimePanic
2015-01-31 19:36 - 2015-01-31 19:36 - 10758914 _____ () C:\Users\Markus\Downloads\tipdefe.zip
2015-01-31 19:33 - 2015-01-31 19:33 - 06374592 _____ (Tim Kosse) C:\Users\Markus\Downloads\FileZilla_3.10.1_win32-setup.exe
2015-01-31 19:33 - 2015-01-31 19:33 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\FileZilla
2015-01-31 19:33 - 2015-01-31 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-01-31 19:33 - 2015-01-31 19:33 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2015-01-31 19:33 - 2014-11-30 04:38 - 51718075 _____ () C:\Users\Markus\AppData\Roaming\autostarter.exe
2015-01-31 09:14 - 2015-01-31 19:55 - 00001330 _____ () C:\WINDOWS\system32\Service_KMS.log
2015-01-30 11:09 - 2015-01-30 12:48 - 00000000 ____D () C:\Users\Markus\Documents\BLSV
2015-01-29 15:39 - 2015-01-29 15:39 - 00008228 _____ () C:\Users\Markus\AppData\Local\recently-used.xbel
2015-01-29 11:47 - 2015-01-29 11:47 - 01191200 _____ () C:\Users\Markus\Downloads\Visitenkarten in 2 Minuten - CHIP-Installer.exe
2015-01-29 11:18 - 2015-01-29 11:18 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\1clickmoviedownloader.com
2015-01-29 11:18 - 2015-01-29 11:18 - 00000000 ____D () C:\Program Files (x86)\1clickmoviedownloader.com
2015-01-29 11:16 - 2015-01-29 11:16 - 00497704 _____ () C:\Users\Markus\Downloads\Matchware_Mindview_5.0.152_key_generator.exe
2015-01-26 21:33 - 2015-01-26 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-23 12:32 - 2015-01-23 12:32 - 00000000 ____D () C:\Users\Markus\Documents\Outlook-Dateien
2015-01-19 17:29 - 2015-01-29 17:29 - 00001274 _____ () C:\WINDOWS\system32\AutoPico.log
2015-01-19 15:08 - 2015-01-19 15:08 - 00003706 _____ () C:\WINDOWS\System32\Tasks\AutoPico Daily Restart
2015-01-19 15:08 - 2015-01-19 15:08 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Eziriz
2015-01-19 15:08 - 2015-01-19 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
2015-01-19 15:08 - 2015-01-19 15:08 - 00000000 ____D () C:\Program Files\KMSpico
2015-01-19 11:00 - 2015-01-19 11:00 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2015-01-19 11:00 - 2015-01-19 11:00 - 00000000 ____D () C:\Users\Markus\AppData\Local\TeamViewer
2015-01-19 10:59 - 2015-01-19 11:00 - 07822880 _____ (TeamViewer GmbH) C:\Users\Markus\Downloads\TeamViewer_Setup.exe
2015-01-19 10:17 - 2015-01-19 10:17 - 00000987 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-01-15 15:55 - 2015-01-30 12:12 - 00000000 ____D () C:\Users\Markus\Documents\athos-c
2015-01-15 11:33 - 2015-01-15 11:33 - 00017431 _____ () C:\Users\Markus\Downloads\recoverDeletedMessages-0.4.xpi
2015-01-15 11:18 - 2015-01-15 11:18 - 00000000 ____D () C:\Users\Markus\Desktop\ZuLA
2015-01-14 19:21 - 2015-01-15 09:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-14 09:12 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-14 09:12 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-14 09:12 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-14 09:12 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-14 09:12 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-14 09:12 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-14 09:12 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-14 09:12 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-14 09:12 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-14 09:12 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-14 09:12 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-14 09:12 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-14 09:12 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-14 09:12 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-14 09:12 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-14 09:12 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-14 09:12 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-14 09:12 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-14 09:12 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-14 09:12 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-14 09:12 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-14 09:12 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-14 09:12 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-14 09:12 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-14 09:12 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-14 09:12 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-14 09:12 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-14 09:12 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-14 09:12 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-14 09:12 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-14 09:12 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-13 13:36 - 2015-01-13 13:39 - 66461801 _____ () C:\Users\Markus\Downloads\Turnen nach Geraten.zip
2015-01-13 13:36 - 2015-01-13 13:39 - 57295394 _____ () C:\Users\Markus\Downloads\Turnen allgemeine Infos und Literatur.zip
2015-01-10 14:48 - 2015-01-10 14:48 - 00000666 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gramblr.lnk
2015-01-10 14:48 - 2015-01-10 14:48 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gramblr
2015-01-10 14:48 - 2015-01-10 14:48 - 00000000 ____D () C:\Gramblr
2015-01-10 14:46 - 2015-01-10 14:47 - 28516777 _____ () C:\Users\Markus\Downloads\gramblr.zip
2015-01-08 16:46 - 2015-01-08 16:46 - 00000044 _____ () C:\Users\Markus\AppData\Roaming\pidloc.txt
2015-01-08 16:46 - 2015-01-08 16:46 - 00000004 _____ () C:\Users\Markus\AppData\Roaming\pid.txt
2015-01-08 12:42 - 2015-01-08 12:42 - 00003256 _____ () C:\WINDOWS\System32\Tasks\{6255608A-A0F8-4836-8532-E551C109CF95}
2015-01-08 12:40 - 2015-01-08 12:56 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\980D3B6B-FDC9-49D9-AD35-0DB2C659A489
2015-01-08 12:15 - 2015-01-08 12:15 - 00000000 __SHD () C:\Users\Markus\AppData\Local\EmieUserList
2015-01-08 12:15 - 2015-01-08 12:15 - 00000000 __SHD () C:\Users\Markus\AppData\Local\EmieSiteList
2015-01-08 12:15 - 2015-01-08 12:15 - 00000000 __SHD () C:\Users\Markus\AppData\Local\EmieBrowserModeList
2015-01-08 10:24 - 2015-01-08 10:24 - 00005264 _____ () C:\Users\Markus\Documents\german_spelling_dictionary-1.0-tb+fx-windows.xpi
2015-01-08 10:18 - 2015-01-08 10:17 - 00327913 _____ () C:\Users\Markus\Documents\german_dictionary-2.0.4-tb+fx+an+sm.xpi
2015-01-07 22:48 - 2015-01-07 22:48 - 00003209 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlexPoints 2.01.lnk
2015-01-07 22:48 - 2015-01-07 22:48 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Weight Watchers
2015-01-07 11:26 - 2015-01-07 11:27 - 00034551 _____ () C:\Users\Markus\Downloads\webde-adressbuch(1).ldif
2015-01-07 11:24 - 2015-01-07 11:24 - 00034551 _____ () C:\Users\Markus\Downloads\webde-adressbuch.ldif
2015-01-07 10:55 - 2015-01-07 10:55 - 00002114 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2015-01-07 10:55 - 2015-01-07 10:55 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Thunderbird
2015-01-07 10:55 - 2015-01-07 10:55 - 00000000 ____D () C:\Users\Markus\AppData\Local\Thunderbird
2015-01-07 10:54 - 2015-01-07 10:54 - 26316120 _____ (Mozilla) C:\Users\Markus\Downloads\Thunderbird Setup 31.3.0.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-31 21:39 - 2014-10-30 12:57 - 00000000 ____D () C:\Users\Markus
2015-01-31 21:38 - 2014-09-24 07:17 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-31 21:38 - 2014-09-24 06:43 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-31 21:38 - 2014-09-24 06:43 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-31 20:01 - 2013-08-22 15:46 - 00417250 _____ () C:\WINDOWS\setupact.log
2015-01-31 20:01 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-31 19:44 - 2014-10-30 12:47 - 01999484 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-31 19:40 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-31 19:39 - 2014-02-28 18:08 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-31 19:38 - 2014-02-27 18:02 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3940889189-91140868-2642085307-1002
2015-01-31 19:33 - 2014-02-27 23:16 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\UseNeXT
2015-01-31 19:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-31 09:26 - 2014-10-30 17:33 - 00000000 ____D () C:\Users\Markus\AppData\Local\Deployment
2015-01-31 09:26 - 2014-10-30 16:55 - 00000000 __RDO () C:\Users\Markus\OneDrive
2015-01-31 09:26 - 2014-01-06 19:57 - 00000000 ____D () C:\Users\Markus\Documents\Citavi 4
2015-01-31 09:13 - 2014-09-23 22:06 - 00014070 _____ () C:\WINDOWS\PFRO.log
2015-01-31 09:13 - 2014-02-28 11:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-31 09:13 - 2013-08-22 15:44 - 00528952 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-29 16:22 - 2013-01-16 17:12 - 00000000 ____D () C:\Users\Markus\.gimp-2.8
2015-01-29 16:10 - 2012-12-24 21:18 - 00000000 ___RD () C:\Users\Markus\Dropbox
2015-01-29 11:08 - 2014-02-27 18:37 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Dropbox
2015-01-28 16:53 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-27 20:19 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-26 13:39 - 2014-07-08 14:39 - 00000000 ____D () C:\Users\Markus\AppData\Local\gtk-2.0
2015-01-26 09:39 - 2014-02-28 18:08 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-01-24 21:20 - 2014-11-14 11:42 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2014-11-14 11:42 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-20 11:23 - 2013-01-18 15:53 - 00000000 ____D () C:\Users\Markus\Desktop\Kamel
2015-01-20 10:33 - 2014-12-16 20:01 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2015-01-20 10:33 - 2014-12-16 19:57 - 00000000 ____D () C:\Program Files (x86)\Image-Line
2015-01-19 11:34 - 2014-06-01 12:49 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\TeamViewer
2015-01-19 10:17 - 2014-06-01 12:50 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-01-15 12:04 - 2014-01-05 17:09 - 00000000 ____D () C:\Users\Markus\Documents\Hoden Records
2015-01-15 12:02 - 2014-03-10 13:13 - 00000000 ____D () C:\Users\Markus\Documents\VHS
2015-01-14 22:13 - 2013-01-07 19:19 - 00000000 ____D () C:\Users\Markus\Documents\Markus
2015-01-14 10:32 - 2014-03-02 01:40 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\MediaMonkey
2015-01-14 10:10 - 2014-03-01 08:22 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 10:05 - 2014-03-01 08:22 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-13 13:17 - 2013-10-16 19:02 - 00000000 ____D () C:\Users\Markus\Documents\Calibre-Bibliothek
2015-01-11 17:56 - 2014-11-25 18:25 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-07 22:46 - 2012-09-10 23:15 - 00000000 ____D () C:\WINDOWS\Downloaded Installations
2015-01-03 19:21 - 2014-04-15 22:03 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\calibre

==================== Files in the root of some directories =======

2015-01-31 19:33 - 2014-11-30 04:38 - 51718075 _____ () C:\Users\Markus\AppData\Roaming\autostarter.exe
2015-01-31 19:39 - 2015-01-31 19:39 - 0605048 _____ () C:\Users\Markus\AppData\Roaming\loadit.exe
2010-05-25 20:02 - 2010-05-25 20:02 - 6198784 _____ () C:\Users\Markus\AppData\Roaming\NavigiumComputertraining7BG.exe
2015-01-08 16:46 - 2015-01-08 16:46 - 0000004 _____ () C:\Users\Markus\AppData\Roaming\pid.txt
2015-01-08 16:46 - 2015-01-08 16:46 - 0000044 _____ () C:\Users\Markus\AppData\Roaming\pidloc.txt
2014-03-03 21:45 - 2014-03-10 13:14 - 0001119 _____ () C:\Users\Markus\AppData\Roaming\SAS7_000.DAT
2015-01-31 19:39 - 2015-01-31 19:39 - 0000032 _____ () C:\Users\Markus\AppData\Roaming\url.txt
2014-03-03 19:58 - 2014-03-04 12:08 - 0007295 _____ () C:\Users\Markus\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2015-01-29 15:39 - 2015-01-29 15:39 - 0008228 _____ () C:\Users\Markus\AppData\Local\recently-used.xbel
2014-05-17 23:16 - 2014-05-17 23:16 - 0007597 _____ () C:\Users\Markus\AppData\Local\Resmon.ResmonCfg

Some content of TEMP:
====================
C:\Users\Markus\AppData\Local\Temp\02378de2.exe
C:\Users\Markus\AppData\Local\Temp\02380dd0.exe
C:\Users\Markus\AppData\Local\Temp\adobe .exe
C:\Users\Markus\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpx_nfrw.dll
C:\Users\Markus\AppData\Local\Temp\film.exe
C:\Users\Markus\AppData\Local\Temp\KMSpico_setup.exe
C:\Users\Markus\AppData\Local\Temp\Runner2.exe
C:\Users\Markus\AppData\Local\Temp\Runner4.exe
C:\Users\Markus\AppData\Local\Temp\smarter.exe
C:\Users\Markus\AppData\Local\Temp\SRLDetectionLibrary6347235074791738351.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 09:25

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-01-2015 01
Ran by Markus at 2015-01-31 21:42:19
Running from C:\Users\Markus\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Acer Backup Manager (HKLM-x32\...\InstallShield_{9DDDF20E-9FD1-4434-A43E-E7889DBC9420}) (Version: 4.0.0.0059 - NTI Corporation)
Acer Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3007 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3006 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3011 - Acer Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Backup Manager v4 (x32 Version: 4.0.0.0059 - NTI Corporation) Hidden
Broadcom Card Reader Driver Installer (HKLM\...\{F0A7DF2F-0BE0-470F-B137-D7A19F977189}) (Version: 15.4.4.2 - Broadcom Corporation)
calibre 64bit (HKLM\...\{EB67BA83-2B13-4338-8E91-F0EEBFCA52A3}) (Version: 1.6.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.4.0.28 - Swiss Academic Software)
Contents64 (Version: 17.0.0.249 - Corel Corporation) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Dropbox (HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
ETDWare PS/2-X64 11.6.4.001_WHQL (HKLM\...\Elantech) (Version: 11.6.4.001 - ELAN Microelectronic Corp.)
FileZilla Client 3.9.0.6 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse)
Free YouTube Download version 3.2.41.623 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.41.623 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.43.806 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.43.806 - DVDVideoSoft Ltd.)
FreeTVDownloader (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - 1clickmoviedownloader.com) <==== ATTENTION
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Gramblr (HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\Gramblr) (Version: 1.0.0 - Gramblr) <==== ATTENTION!
ICA (x32 Version: 17.0.0.249 - Corel Corporation) Hidden
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3004 - Acer Incorporated)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)
Inkscape 0.48.5 (HKLM-x32\...\Inkscape) (Version: 0.48.5 - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IPM_VS_Pro64 (Version: 17.0 - Corel Corporation) Hidden
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Launch Manager (HKLM-x32\...\LManager) (Version: 7.0.4 - Acer Inc.)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3003 - Acer Incorporated)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.3.0 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
Navigium 7.7 (HKLM-x32\...\{ACB60BC7-8F52-4A9F-8E79-B36BD674CE22}) (Version: 7.7 - Philipp Niederau)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.2.3.45 - Symantec Corporation)
Norton Online Backup ARA (x32 Version: 4.1.0.10 - Symantec Corporation) Hidden
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9008 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.01.3200 - Acer)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Paragon Backup & Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PoiZone (HKLM-x32\...\PoiZone) (Version:  - Image-Line)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.05 - Qualcomm Atheros)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Sawer (HKLM-x32\...\Sawer) (Version:  - Image-Line)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Setup (x32 Version: 17.0.0.249 - Corel Corporation) Hidden
Shadowgun: DeadZone (HKLM-x32\...\Shadowgun DeadZone) (Version: 2.2.2 - MADFINGER Games)
Share64 (Version: 17.0.0.249 - Corel Corporation) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
System Requirements Lab CYRI (HKLM-x32\...\{6C8C4577-8E15-4C63-96ED-D40F2072FF74}) (Version: 6.0.19.0 - Husdawg, LLC)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36897 - TeamViewer)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
TimePanic FE (x32 Version: 4.6.865 - TimePanic) Hidden
TimePanic FE 4.6 (HKLM-x32\...\TimePanic FE 4.6.865) (Version: 4.6.865 - TimePanic)
TIPP10 Version 2.1.0 (HKLM-x32\...\TIPP10_is1) (Version:  - (c) 2006-2011, Tom Thielicke IT Solutions)
VirtualDJ 8 (HKLM-x32\...\{85E12659-D3A1-4583-BA1C-95DF53C3C632}) (Version: 8.0.2087.0 - Atomix Productions)
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VSClassic64 (Version: 17.0.0.249 - Corel Corporation) Hidden
VSPro64 (Version: 17.0.0.249 - Corel Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3940889189-91140868-2642085307-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Markus\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

14-01-2015 10:04:03 Windows Update
23-01-2015 15:03:17 Windows Update
27-01-2015 20:18:18 Windows Update
31-01-2015 19:37:34 TimePanic FE wird installiert

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2015-01-19 11:32 - 00000892 ____A C:\WINDOWS\system32\Drivers\etc\hosts
192.168.0.2	EXKNI01.Knittlingen.local
80.147.127.53	mx.holzschuh.de


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {105A7419-51A5-423E-8DD5-DBA78DBFABE6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {4EBBB5D7-B5B5-47E5-82B9-49459C88AEE3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {57BACAFB-862F-46A0-A9B6-6AC87DE31413} - System32\Tasks\{3B24E943-969F-4CF0-ABDE-7E6E9ADE384D} => pcalua.exe -a "C:\Program Files (x86)\Acer\Acer Cloud\AcerCloudSetup.exe" -c -uninstall
Task: {72530E45-2B30-4D39-968E-D88374C71548} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-26] (Adobe Systems Incorporated)
Task: {8BB0CDFD-3A29-4852-BA12-6BDE8FAE6D59} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)
Task: {904A3FAF-D081-4C5B-AA25-9DAF74CDAA83} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {9A7E2FB6-112B-424B-AEF7-3EA82553C89C} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-10-20] ()
Task: {AB6E26BC-8765-43F1-B30C-B9CBC16AAD3D} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {B227C622-A28F-41A6-969A-91812DFB10EC} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-14] (Microsoft Corporation)
Task: {B8E53894-308B-49B1-BB09-5B201FBE074B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C200AA14-5C80-41A6-B06B-8C960CDF1C5D} - System32\Tasks\{6255608A-A0F8-4836-8532-E551C109CF95} => pcalua.exe -a C:\Users\Markus\Documents\UseNeXT\alt.binaries.de\Sample\setup.exe -d C:\Users\Markus\Documents\UseNeXT\alt.binaries.de\Sample
Task: {E6AD9FF2-753D-4AC8-872A-135F9D5B8175} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-24] ()
Task: {F46A62FF-663D-4BC9-9D02-BE110DC8345D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:7FFED16F
AlternateDataStreams: C:\Users\Markus\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Markus\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "UseAlternateShell"="1"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "Acer Backup Manager Tray.lnk"
HKLM\...\StartupApproved\Run32: => "Norton Online Backup"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\StartupApproved\StartupFolder: => "Dropbox.lnk"
HKU\S-1-5-21-3940889189-91140868-2642085307-1002\...\StartupApproved\Run: => "DAEMON Tools Lite"

========================= Accounts: ==========================

Administrator (S-1-5-21-3940889189-91140868-2642085307-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-3940889189-91140868-2642085307-501 - Limited - Disabled) => C:\Users\Gast
Markus (S-1-5-21-3940889189-91140868-2642085307-1002 - Administrator - Enabled) => C:\Users\Markus
UpdatusUser (S-1-5-21-3940889189-91140868-2642085307-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/31/2015 07:32:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xa10
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (01/31/2015 09:23:53 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (01/30/2015 11:09:40 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm thunderbird.exe, Version 31.4.0.5487 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 120c

Startzeit: 01d03c74ab3d34d2

Endzeit: 24

Anwendungspfad: C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

Berichts-ID: 18d9d9ec-a868-11e4-bebe-b888e3bef697

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/30/2015 11:02:03 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm thunderbird.exe, Version 31.4.0.5487 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 42c

Startzeit: 01d03b22d22bb716

Endzeit: 57

Anwendungspfad: C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

Berichts-ID: 07da8218-a867-11e4-bebe-b888e3bef697

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/29/2015 11:21:14 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm smarter.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1bf0

Startzeit: 01d03bacca87dc3d

Endzeit: 4294967295

Anwendungspfad: C:\Users\Markus\AppData\Local\Temp\smarter.exe

Berichts-ID: 8d302b4f-a7a0-11e4-bebe-b888e3bef697

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/29/2015 09:49:14 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (01/28/2015 06:25:50 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\WINDOWS\system32\wbem\wmiaprpl.dll8

Error: (01/28/2015 06:25:50 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: 

Error: (01/28/2015 06:25:50 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: MSDTCC:\WINDOWS\system32\msdtcuiu.DLL8

Error: (01/28/2015 06:25:49 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: LsaC:\Windows\System32\Secur32.dll8


System errors:
=============
Error: (01/31/2015 09:42:32 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:32 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:31 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:31 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:27 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:27 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:23 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:23 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:20 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}

Error: (01/31/2015 09:42:20 PM) (Source: DCOM) (EventID: 10005) (User: MARKUSLAPTOP)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}


CodeIntegrity Errors:
===================================
  Date: 2015-01-31 09:26:32.490
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-15 09:55:16.303
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-01-04 14:24:04.880
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-12-21 16:47:33.729
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-12-13 09:58:14.459
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-12-09 10:19:02.273
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-12-01 16:13:10.913
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-24 10:48:18.935
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-16 13:01:24.999
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-05 12:28:03.357
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3110M CPU @ 2.40GHz
Percentage of memory in use: 22%
Total physical RAM: 3911.27 MB
Available physical RAM: 3012.41 MB
Total Pagefile: 15175.27 MB
Available Pagefile: 14338.61 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:445.41 GB) (Free:146.56 GB) NTFS
Drive f: () (Removable) (Total:0.94 GB) (Free:0.59 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: AA28A361)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 962.5 MB) (Disk ID: C9DD1540)
Partition 1: (Not Active) - (Size=962 MB) - (Type=06)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-31 21:56:35
Windows 6.3.9600  x64 \Device\Harddisk0\DR0 -> \Device\00000031 ST9500325AS rev.0001SDM1 465,76GB
Running: 7p0klsg6.exe; Driver: C:\Users\Markus\AppData\Local\Temp\kxldipob.sys


---- User code sections - GMER 2.1 ----

.text    C:\WINDOWS\explorer.exe[456] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 714    00007fff41e4154a 4 bytes [E4, 41, FF, 7F]
.text    C:\WINDOWS\explorer.exe[456] C:\WINDOWS\SYSTEM32\MSIMG32.dll!GradientFill + 722    00007fff41e41552 4 bytes [E4, 41, FF, 7F]
.text    C:\WINDOWS\explorer.exe[456] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 98   00007fff41e4162a 4 bytes [E4, 41, FF, 7F]
.text    C:\WINDOWS\explorer.exe[456] C:\WINDOWS\SYSTEM32\MSIMG32.dll!TransparentBlt + 122  00007fff41e41642 4 bytes [E4, 41, FF, 7F]

---- Threads - GMER 2.1 ----

Thread   C:\WINDOWS\system32\csrss.exe [464:480]                                            fffff96000912b90
Thread   C:\WINDOWS\explorer.exe [456:1744]                                                 00007fff3c88d73c
---- Processes - GMER 2.1 ----

Library  F:\7p0klsg6.exe (*** suspicious ***) @ F:\7p0klsg6.exe [1364]                      0000000000400000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                              unknown MBR code

---- EOF - GMER 2.1 ----
         

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 31.01.2015
Suchlauf-Zeit: 21:57:18
Logdatei: malwarebytes.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.11.01.06
Rootkit Datenbank: v2014.11.01.02
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Markus

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 483598
Verstrichene Zeit: 28 Min, 7 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 2
PUP.Optional.1ClickDownload.A, HKU\S-1-5-21-3940889189-91140868-2642085307-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\1ClickDownload, , [f6a42f074b318aac4c85d2a6a85c38c8], 
PUP.Optional.1ClickMovieDownloader.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\1ClickDownload, , [217984b29ae2d660ecc7f702748e41bf], 

Registrierungswerte: 3
PUM.UserWLoad, HKU\S-1-5-21-3940889189-91140868-2642085307-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|Load, C:\Users\Markus\LOCALS~1\Temp\msuxzb.exe, , [900a0b2b1a628aaca3e6e4859a695aa6]
Trojan.Agent, HKU\S-1-5-21-3940889189-91140868-2642085307-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|Load, C:\Users\Markus\LOCALS~1\Temp\msuxzb.exe, , [b2e887af6c1048ee70de51805ea5837d]
Hijack.Shell.Gen, HKU\S-1-5-21-3940889189-91140868-2642085307-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|Shell, C:\Users\Markus\AppData\Roaming\loadit.exe, , [801ad2644636d561a3af16ece61e49b7]

Registrierungsdaten: 1
Broken.OpenCommand, HKCR\regfile\shell\open\command, "regedit.exe" "Gut: (regedit.exe "Schlecht: ("regedit.exe" "%1"),,[ffffffffffffffffffffffffffffffff]")", %4, %5

Ordner: 1
PUP.Optional.1ClickMovieDownloader.A, C:\Program Files (x86)\1clickmoviedownloader.com, , [217984b29ae2d660ecc7f702748e41bf], 

Dateien: 8
PUP.Optional.Unizeto, C:\Users\Markus\Downloads\FileZilla_3.10.1_win32-setup.exe, , [3b5f043203794aecd5f3f5b6b15306fa], 
Trojan.Agent.Gen, C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe, , [b0ea39fd90ecef47a0edd35946bdd22e], 
Trojan.Agent, C:\Users\Markus\AppData\Local\Temp\adobe .exe, , [eeacf541bcc0a78fabbcfc4045bf7987], 
Trojan.Winlock.Gen, C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ja.lnk, , [ebaffe381b61c373b929df68e91b7e82], 
Malware.Trace, C:\Users\Markus\AppData\Roaming\pid.txt, , [297152e43e3e81b5857ec4d53bc92ad6], 
Malware.Trace, C:\Users\Markus\AppData\Roaming\pidloc.txt, , [2b6f0a2ccdaf92a435cea4f554b024dc], 
PUP.Optional.1ClickMovieDownloader.A, C:\Program Files (x86)\1clickmoviedownloader.com\FreeTVDownloader.exe, , [217984b29ae2d660ecc7f702748e41bf], 
PUP.Optional.1ClickMovieDownloader.A, C:\Program Files (x86)\1clickmoviedownloader.com\uninst.exe, , [217984b29ae2d660ecc7f702748e41bf], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)