*Sorry mit dem Logs im Text, muss ich überlesen haben.* Zitat:
Hallo Zusammen,
ich habe dummerweise auf eine .exe geklickt, nichts passierte. Also nochmal drauf.
Da stieg der Gedanke eines Virus/Trojaner in mir hoch. Erstmal diese .exe gelöscht.
Ich fand 2 Prozesse die ich beendete (love.exe) und die .exe löschte.
Auch unter AppData waren 2 Verzeichnisse die da nicht hingehören mit merkwürdigen .exe, auch gelöscht.
McAfee Antivir fand nichts.
Dennoch hatte ich ein mulmiges Gefühl.
Bitdefender Rescue Disc fand gen.variant.barys und entfernte diesen.
mbar fand noch wchelper.dll und dxaiau.exe, löschte aber beide nach einem Reboot.
Ich setzte dennoch das System mit Windows Mitteln auf einen Stand von Freitag zurück (Befall seit gestern).
Ich habe jetzt alle logs aus der Faq erstellt und bitte drum, daß sie sich einer von Euch anschaut ob das System nun clean ist oder doch noch ein Befall vorhanden ist....
Danke im Voraus
Gruß Marco
| Addition.txt: Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01
Ran by Ersatzuser at 2013-11-12 11:18:11
Running from C:\Users\Ersatzuser\Desktop\scan
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender (Ersatzuser - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Ersatzuser - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}
==================== Installed Programs ======================
7-Zip 9.22 (x64 edition) (Version: 9.22.00.0)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.5.146)
AMD Accelerated Video Transcoding (Version: 12.5.100.20806)
AMD APP SDK Runtime (Version: 10.0.938.2)
AMD AVIVO64 Codecs (Version: 12.3.103.20326)
AMD Catalyst Install Manager (Version: 8.0.881.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.0806.1156.19437)
Catalyst Control Center InstallProxy (x32 Version: 2012.0806.1156.19437)
Catalyst Control Center Localization All (x32 Version: 2012.0806.1156.19437)
Catalyst Control Center Profiles Mobile (x32 Version: 2012.0806.1156.19437)
CCC Help Chinese Standard (x32 Version: 2012.0806.1155.19437)
CCC Help Chinese Traditional (x32 Version: 2012.0806.1155.19437)
CCC Help Danish (x32 Version: 2012.0806.1155.19437)
CCC Help Dutch (x32 Version: 2012.0806.1155.19437)
CCC Help English (x32 Version: 2012.0806.1155.19437)
CCC Help Finnish (x32 Version: 2012.0806.1155.19437)
CCC Help French (x32 Version: 2012.0806.1155.19437)
CCC Help German (x32 Version: 2012.0806.1155.19437)
CCC Help Italian (x32 Version: 2012.0806.1155.19437)
CCC Help Japanese (x32 Version: 2012.0806.1155.19437)
CCC Help Korean (x32 Version: 2012.0806.1155.19437)
CCC Help Norwegian (x32 Version: 2012.0806.1155.19437)
CCC Help Portuguese (x32 Version: 2012.0806.1155.19437)
CCC Help Russian (x32 Version: 2012.0806.1155.19437)
CCC Help Spanish (x32 Version: 2012.0806.1155.19437)
CCC Help Swedish (x32 Version: 2012.0806.1155.19437)
ccc-utility64 (Version: 2012.0806.1156.19437)
Conexant HD Audio (x32 Version: 1.0.46.0)
Conexant SmartAudio HD (Version: 8.54.40.0)
Data Lifeguard Diagnostic for Windows 1.24 (x32)
Dell System Detect (HKCU Version: 5.1.0.41)
Dell System Detect Bootstrapper (HKCU Version: 5.1.0.41)
Dell Touchpad (Version: 11.3.5.4)
DisplayLink Core Software (Version: 7.4.51572.0)
DisplayLink Graphics (Version: 7.2.47157.0)
EaseUS Partition Master 9.2.2 (x32)
FileZilla Client 3.7.3 (x32 Version: 3.7.3)
FRITZ!Box USB-Fernanschluss (HKCU Version: 2.3.1.0)
FRITZ!Box-Fernzugang einrichten (x32 Version: 1.0.3)
FRITZ!Fernzugang (Version: 1.2.6)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3097)
Intel(R) Management Engine Components (x32 Version: 8.0.1.1399)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 2.6.1211.0294)
Intel(R) Rapid Storage Technology (x32 Version: 11.7.0.1013)
Intel® Trusted Connect Service Client (Version: 1.23.219.2)
IrfanView (remove only) (x32 Version: 4.35)
Java 7 Update 25 (64-bit) (Version: 7.0.250)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
LibreOffice 3.6 (x32 Version: 3.6.6.2)
Logitech Harmony Remote Software 7 (x32 Version: 7.7.0.0)
McAfee SecurityCenter (x32 Version: 12.8.856)
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Language Pack 2010 - German/Deutsch (x32 Version: 14.0.4763.1000)
Microsoft Office O MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000)
Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.4763.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.4763.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.4763.1000)
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office SharePoint Designer MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office X MUI (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 25.0)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
Mp3tag v2.55a (x32 Version: v2.55a)
Notepad++ (x32 Version: 6.4.5)
PDF24 Creator 5.7.0 (x32)
PokerStars.eu (x32)
POP Peeper (x32)
PowerXpressHybrid (x32 Version: 1.00.0000)
PuTTY development snapshot 2013-09-19:r10042 (x32 Version: 2013-09-19:r10042)
PX Profile Update (x32 Version: 1.00.1.)
Quickset64 (Version: 10.15.017)
Realtek Card Reader (x32 Version: 6.2.9200.39052)
Remote Control USB Driver (x32 Version: 2.3.2.317)
SABnzbd 0.7.16 (x32 Version: 0.7.16)
Samsung Magician (x32 Version: 4.2.1)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.27.0)
Start Menu 8 (x32 Version: 1.3.0.0)
swMSM (x32 Version: 12.0.0.1)
System Requirements Lab for Intel (x32 Version: 4.5.11.0)
Transmission Remote GUI 5.0 (x32)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0)
VLC media player 2.0.8 (x32 Version: 2.0.8)
Winamp (x32 Version: 5.64 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
==================== Restore Points =========================
03-11-2013 07:27:59 Installed System Requirements Lab for Intel
05-11-2013 10:56:50 Installed DisplayLink Graphics
08-11-2013 14:27:18 Installed Remote Control USB Driver
11-11-2013 20:28:26 Installed Microsoft Office Professional Plus 2010
==================== Hosts content: ==========================
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {37A8EE68-4AB9-45BD-B930-D587CF0907D6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\System32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => C:\Windows\System32\AppXDeploymentClient.dll [2013-09-30] (Microsoft Corporation)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A5CEC636-56CA-4FE9-A5C7-5BB3A200AF05} - System32\Tasks\StartMenuAutoupdate => C:\Program Files (x86)\IObit\Start Menu 8\AutoUpdate.exe [2013-09-29] (IObit)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
==================== Loaded Modules (whitelisted) =============
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-01-30 02:40 - 2010-01-30 02:40 - 04254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2013-10-03 23:42 - 2013-10-03 23:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-09-19 10:11 - 2012-07-18 10:03 - 00165024 _____ () C:\Program Files\Conexant\SA3\MaxxAudioWrapper.dll
2013-09-19 09:51 - 2013-09-29 18:05 - 00348992 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madExcept_.bpl
2013-09-19 09:51 - 2013-09-29 18:05 - 00183616 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madBasic_.bpl
2013-09-19 09:51 - 2013-09-29 18:05 - 00051008 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madDisAsm_.bpl
2013-09-19 09:51 - 2013-09-29 18:05 - 00040256 _____ () C:\Program Files (x86)\IObit\Start Menu 8\winkey.dll
2013-11-05 08:48 - 2013-11-05 08:48 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\19a867cd2b799b42f121cd45df10aefb\PSIClient.ni.dll
2013-09-19 10:08 - 2012-01-20 22:53 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-11-06 09:24 - 2013-11-06 09:24 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\WINDOWS\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== Faulty Device Manager Devices =============
Name: AVM USB-Fernanschluss
Description: AVM USB-Fernanschluss
Class Guid: {59e75f1d-160e-4aba-bb5c-1c179b8e9b7a}
Manufacturer: AVM Berlin
Service: avmaura
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Intel(R) Centrino(R) Wireless-N 2230
Description: Intel(R) Centrino(R) Wireless-N 2230
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel Corporation
Service: NETwNe64
Problem: : This device is Ersatzuser. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/12/2013 09:29:53 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/12/2013 09:29:49 AM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (11/11/2013 10:44:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (11/11/2013 10:44:00 PM) (Source: Microsoft-Windows-Defrag) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (11/11/2013 09:52:52 PM) (Source: Office Software Protection Platform Service) (User: )
Description: Acquisition of Product Certificate failed. hr=0xC004C003
Sku Id=fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7
Error: (11/11/2013 09:52:52 PM) (Source: Office Software Protection Platform Service) (User: )
Description: License acquisition failure details.
hr=0xC004C003
Error: (11/11/2013 09:48:03 PM) (Source: Office Software Protection Platform Service) (User: )
Description: Acquisition of Product Certificate failed. hr=0xC004C003
Sku Id=fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7
Error: (11/11/2013 09:48:03 PM) (Source: Office Software Protection Platform Service) (User: )
Description: License acquisition failure details.
hr=0xC004C003
Error: (11/11/2013 08:34:44 PM) (Source: Application Error) (User: )
Description: Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen werden:
Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten
Speichertreibern, oder der Datenträger fehlt.
Das Programm Visual Basic Command Line Compiler wurde wegen dieses Fehlers geschlossen.
Programm: Visual Basic Command Line Compiler
Datei:
Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1. Öffnen Sie die Datei erneut.
Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.
2.
Wenn Sie weiterhin nicht auf die Datei zugreifen können und
- diese sich im Netzwerk befindet,
dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann.
- diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.
3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht.
5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.
Zusätzliche Daten
Fehlerwert: 00000000
Datenträgertyp: 0
Error: (11/11/2013 08:34:44 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: winlogon.exe, Version: 8.0.50727.7905, Zeitstempel: 0x523ef46a
Name des fehlerhaften Moduls: winlogon.exe, Version: 8.0.50727.7905, Zeitstempel: 0x523ef46a
Ausnahmecode: 0xc0000096
Fehleroffset: 0x0000175d
ID des fehlerhaften Prozesses: 0x3fc
Startzeit der fehlerhaften Anwendung: 0xwinlogon.exe0
Pfad der fehlerhaften Anwendung: winlogon.exe1
Pfad des fehlerhaften Moduls: winlogon.exe2
Berichtskennung: winlogon.exe3
Vollständiger Name des fehlerhaften Pakets: winlogon.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: winlogon.exe5
System errors:
=============
Error: (11/12/2013 11:17:15 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\COMMON FILES\MCAFEE\PLATFORM\MCUICNT.EXE
Error: (11/12/2013 11:17:14 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\COMMON FILES\MCAFEE\PLATFORM\MCSVCHOST\MCSVHOST.EXE
Error: (11/12/2013 11:17:14 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE\MFEFIRE.EXE
Error: (11/12/2013 11:17:14 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\COMMON FILES\MCAFEE\AMCORE\MCSHIELD.EXE
Error: (11/12/2013 11:17:14 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\WINDOWS\SYSTEM32\MFEVTPS.EXE
Error: (11/12/2013 11:17:14 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\MCAFEE\MSC\MCAPEXE.EXE
Error: (11/12/2013 11:12:04 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\COMMON FILES\MCAFEE\PLATFORM\CORE\MCHOST.EXE
Error: (11/12/2013 11:12:04 AM) (Source: mbamchameleon) (User: )
Description: \??\C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe
Error: (11/12/2013 11:10:05 AM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
Error: (11/12/2013 11:10:05 AM) (Source: mbamchameleon) (User: )
Description: \??\c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
Microsoft Office Sessions:
=========================
Error: (11/12/2013 09:29:53 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\EaseUS\easeus partition master 9.2.2\DRW\RdfCheck.exe
Error: (11/12/2013 09:29:49 AM) (Source: Microsoft-Windows-Defrag)(User: )
Description: System-reserviertFalscher Parameter. (0x80070057)
Error: (11/11/2013 10:44:02 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\EaseUS\easeus partition master 9.2.2\DRW\RdfCheck.exe
Error: (11/11/2013 10:44:00 PM) (Source: Microsoft-Windows-Defrag)(User: )
Description: System-reserviertFalscher Parameter. (0x80070057)
Error: (11/11/2013 09:52:52 PM) (Source: Office Software Protection Platform Service)(User: )
Description: hr=0xC004C003fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7
Error: (11/11/2013 09:52:52 PM) (Source: Office Software Protection Platform Service)(User: )
Description: hr=0xC004C00300010001(0x00000000, 21:52:51:800 - hxxp://go.microsoft.com/fwlink/?LinkID=120751)
00020001(0x00000000, 21:52:51:800)
00030001(0x00000000, 21:52:51:800 - hxxp://go.microsoft.com)
00030002(0x00000000, 21:52:51:800 - 1)
00020005(0x00000000, 21:52:51:800 - 0)
0002000C(0x00000000, 21:52:51:981 - 302)
0002000E(0x00000000, 21:52:51:981 - https://activation.sls.microsoft.com/slpkc/SLCertifyProduct.asmx?configextension=o14)
00020001(0x00000000, 21:52:51:981)
00030001(0x00000000, 21:52:51:981 - https://activation.sls.microsoft.com)
00030002(0x00000000, 21:52:51:981 - 1)
00020005(0x00000000, 21:52:51:981 - 0)
0002000C(0x00000000, 21:52:52:190 - 500)
00010002(0x8004FC01, 21:52:52:190 - <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="hxxp://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="hxxp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="hxxp://www.w3.org/2001/XMLSchema"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>SoapException</faultstring><detail><HRESULT>0xC004C003</HRESULT><Messages><Message>103 (Activation) - [PA Product key blocked. ---> Product key blocked]</Message></Messages></detail></soap:Fault></soap:Body></soap:Envelope>)
00010003(0x8004FC01, 21:52:52:191)
Error: (11/11/2013 09:48:03 PM) (Source: Office Software Protection Platform Service)(User: )
Description: hr=0xC004C003fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7
Error: (11/11/2013 09:48:03 PM) (Source: Office Software Protection Platform Service)(User: )
Description: hr=0xC004C00300010001(0x00000000, 21:48:02:631 - hxxp://go.microsoft.com/fwlink/?LinkID=120751)
00020001(0x00000000, 21:48:02:631)
00030001(0x00000000, 21:48:02:631 - hxxp://go.microsoft.com)
00030002(0x00000000, 21:48:02:631 - 1)
00020005(0x00000000, 21:48:02:631 - 0)
0002000C(0x00000000, 21:48:02:815 - 302)
0002000E(0x00000000, 21:48:02:815 - https://activation.sls.microsoft.com/slpkc/SLCertifyProduct.asmx?configextension=o14)
00020001(0x00000000, 21:48:02:815)
00030001(0x00000000, 21:48:02:815 - https://activation.sls.microsoft.com)
00030002(0x00000000, 21:48:02:815 - 1)
00020005(0x00000000, 21:48:02:815 - 0)
0002000C(0x00000000, 21:48:03:021 - 500)
00010002(0x8004FC01, 21:48:03:021 - <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="hxxp://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="hxxp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="hxxp://www.w3.org/2001/XMLSchema"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>SoapException</faultstring><detail><HRESULT>0xC004C003</HRESULT><Messages><Message>103 (Activation) - [PA Product key blocked. ---> Product key blocked]</Message></Messages></detail></soap:Fault></soap:Body></soap:Envelope>)
00010003(0x8004FC01, 21:48:03:022)
Error: (11/11/2013 08:34:44 PM) (Source: Application Error)(User: )
Description: Visual Basic Command Line Compiler000000000
Error: (11/11/2013 08:34:44 PM) (Source: Application Error)(User: )
Description: winlogon.exe8.0.50727.7905523ef46awinlogon.exe8.0.50727.7905523ef46ac00000960000175d3fc01cedf1512cfefb6C:\Users\Ersatzuser\AppData\Local\Temp\AppLunch\winlogon.exeC:\Users\Ersatzuser\AppData\Local\Temp\AppLunch\winlogon.exe508b4a82-4b08-11e3-bed8-84a6c8b29e3f
==================== Memory info ===========================
Percentage of memory in use: 27%
Total physical RAM: 8067.35 MB
Available physical RAM: 5859.98 MB
Total Pagefile: 8267.35 MB
Available Pagefile: 6017.53 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB
==================== Drives ================================
Drive c: (SSD) (Fixed) (Total:111.45 GB) (Free:87.4 GB) NTFS
Drive d: (Daten) (Fixed) (Total:930.37 GB) (Free:816.26 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 40AE1B0B)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 932 GB) (Disk ID: 739E0787)
Partition: GPT Partition Type
==================== End Of Log ============================
defogger_disable.log: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:43 on 12/11/2013 (Ersatzuser)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by Ersatzuser (administrator) on DELL-15RSE on 12-11-2013 11:43:59
Running from C:\Users\Ersatzuser\Desktop\scan
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\WINDOWS\system32\atiesrxx.exe
(AMD) C:\WINDOWS\system32\atieclxx.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(Conexant Systems, Inc.) C:\Program Files\Conexant\SA3\CxUtilSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDGesture.exe
(Conexant Systems, Inc.) C:\Program Files\Conexant\SA3\SmartAudio3.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1204144.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(AVM Berlin) C:\Users\Ersatzuser\AppData\Local\Apps\2.0\BPRKPJY7.52V\GYAZV1XK.J3W\frit..tion_1acae14e4778b8d2_0002.0003_7c9366a34786c7f9\fritzbox-usb-fernanschluss.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu8.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\InstallServices64.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu_Hook.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - "C:\WINDOWS\system32\hkcmd.exe"
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2774864 2013-01-09] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SA3\SAcpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [5762408 2013-02-01] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [DellSystemDetect] - C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms [370 2013-09-19] ()
HKCU\...\Run: [AVMUSBFernanschluss] - C:\Users\Ersatzuser\AppData\Local\Apps\2.0\BPRKPJY7.52V\GYAZV1XK.J3W\frit..tion_1acae14e4778b8d2_0002.0003_7c9366a34786c7f9\AVMAutoStart.exe [139264 2013-10-27] (AVM Berlin)
HKCU\...\Runonce: [Shockwave Updater] - [x]
MountPoints2: {c97df00a-2103-11e3-be66-806e6f6e6963} - "E:\setup.exe"
HKLM-x32\...\Run: [mcpltui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-09-24] (McAfee, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe [2081792 2013-03-29] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Startup: C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe (Samsung Electronics.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x964745475CD1CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
FireFox:
========
FF ProfilePath: C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default
FF Homepage: about:home
FF NetworkProxy: "MM3ProxySwitch.type", 0
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20(shExpMatch(host%2C%20'(*.turntable.fm%7Cturntable.fm)')%20%26%26%20url.indexOf('.css')%20%3D%3D%20-1%20%26%26%20url.indexOf('.js')%20%3D%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*'))%20%7B%20return%20'PROXY%20ab-us21.personalitycores.com%3A8000%3B%20PROXY%20ab-us14.personalitycores.com%3A8000%3B%20PROXY%20ab-us17.personalitycores.com%3A8000%3B%20PROXY%20ab-us20.personalitycores.com%3A8000%3B%20PROXY%20ab-us07.personalitycores.com%3A8000%3B%20PROXY%20ab-us11.personalitycores.com%3A8000%3B%20PROXY%20ab-us13.personalitycores.com%3A8000%3B%20PROXY%20ab-us09.personalitycores.com%3A8000%3B%20PROXY%20ab-us22.personalitycores.com%3A8000%3B%20PROXY%20ab-us02.personalitycores.com%3A8000%3B%20PROXY%20ab-us18.personalitycores.com%3A8000%3B%20PROXY%20ab-us01.personalitycores.com%3A8000%3B%20PROXY%20ab-us15.personalitycores.com%3A8000%3B%20PROXY%20ab-us03.personalitycores.com%3A8000%3B%20PROXY%20ab-us16.personalitycores.com%3A8000%3B%20PROXY%20ab-us10.personalitycores.com%3A8000%3B%20PROXY%20ab-us12.personalitycores.com%3A8000%3B%20PROXY%20ab-us08.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: em:name="bug582139(Allow bookmarks button in the nav bar)" - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\bug582139@alice0775
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\ich@maltegoetz.de
FF Extension: MM3-ProxySwitch - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\ProxySwitch@MM3Tools.com
FF Extension: LastPass - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\support@lastpass.com
FF Extension: DownloadHelper - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Default Full Zoom Level - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\{D9A7CBEC-DE1A-444f-A092-844461596C4D}
FF Extension: customization - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\customization@adblockplus.org.xpi
FF Extension: elemhidehelper - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\elemhidehelper@adblockplus.org.xpi
FF Extension: jid1-QpHD8URtZWJC2A - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi
FF Extension: MulticolumnBookmarks - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\MulticolumnBookmarks@Maxim.Kudimov.xpi
FF Extension: scriptish - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\scriptish@erikvold.com.xpi
FF Extension: stealthyextension - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\stealthyextension@gmail.com.xpi
FF Extension: Adblock Plus - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: greasemonkey - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF Extension: No Name - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi
FF Extension: No Name - C:\Users\Ersatzuser\AppData\Roaming\Mozilla\Firefox\Profiles\ywek89xi.default\Extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK
==================== Services (Whitelisted) =================
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [336248 2012-02-02] (AVM Berlin)
R3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [321024 2013-08-22] (Microsoft Corporation)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143736 2011-10-31] (AVM Berlin)
R2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2013-09-19] (Conexant Systems, Inc.)
R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [9281840 2013-10-07] (DisplayLink Corp.)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-01-21] (Intel Corporation)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178048 2013-09-24] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [602944 2013-08-02] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1017016 2013-09-20] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-09-24] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-09-24] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [189304 2011-10-31] (AVM Berlin)
R2 StartMenuService; C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe [75584 2013-09-29] (IObit)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R3 avmaura; C:\Windows\System32\drivers\avmaura.sys [116480 2013-10-27] (AVM Berlin)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [131584 2013-08-22] (Microsoft Corporation)
R3 BthHFAud; C:\Windows\system32\DRIVERS\BthHfAud.sys [32640 2013-08-22] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1345920 2012-11-06] (Motorola Solutions, Inc.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-09-24] (McAfee, Inc.)
S3 DisplayLinkUsbIo_x64; C:\Windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.4.51572.0.sys [46384 2013-10-08] ()
S3 dlcdcncm6_x64; C:\Windows\system32\DRIVERS\dlcdcncm6_x64.sys [80688 2013-10-07] (DisplayLink Corp.)
S3 dlusbaudio; C:\Windows\system32\DRIVERS\dlusbaudio_x64.sys [202128 2013-10-07] (DisplayLink Corp.)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] ()
S3 epmntdrv; C:\Windows\SysWow64\epmntdrv.sys [13896 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] ()
S3 EuGdiDrv; C:\Windows\SysWow64\EuGdiDrv.sys [9160 2013-03-07] ()
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-09-30] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-09-24] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-09-24] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69264 2013-09-24] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519192 2013-09-24] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [781312 2013-09-24] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [390552 2013-09-20] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [95984 2013-09-20] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-09-24] (McAfee, Inc.)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146272 2013-08-22] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [56672 2013-08-22] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
U5 MBAMSwissArmy; C:\Windows\System32\Drivers\MBAMSwissArmy.sys [116440 2013-11-12] (Malwarebytes Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-12 11:32 - 2013-11-12 11:32 - 00116440 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2013-11-12 11:32 - 2013-11-12 11:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-12 11:31 - 2013-11-12 11:31 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2013-11-12 11:17 - 2013-11-12 11:17 - 00000000 ____D C:\FRST
2013-11-12 11:17 - 2013-11-12 11:17 - 00000000 _____ C:\Users\Ersatzuser\defogger_reenable
2013-11-12 10:57 - 2013-11-12 10:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-12 10:56 - 2013-11-12 11:43 - 00000000 ____D C:\Users\Ersatzuser\Desktop\scan
2013-11-11 21:31 - 2013-11-11 21:31 - 00000000 ____D C:\WINDOWS\PCHEALTH
2013-11-11 21:31 - 2013-11-11 21:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Sync Framework
2013-11-11 21:31 - 2013-11-11 21:31 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-11-11 21:29 - 2013-11-12 11:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 8
2013-11-11 21:29 - 2013-11-11 21:29 - 00000000 ____D C:\Program Files\Microsoft Office
2013-11-11 21:29 - 2013-11-11 21:29 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-11-11 21:28 - 2013-11-12 11:22 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-11 21:28 - 2013-11-11 21:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-11-11 21:28 - 2013-11-11 21:28 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Microsoft Help
2013-11-10 19:19 - 2013-11-10 19:19 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\WinRAR
2013-11-10 09:08 - 2013-11-12 11:28 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Deployment
2013-11-09 13:07 - 2013-11-12 11:26 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SABnzbd
2013-11-09 13:07 - 2013-11-12 11:26 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\sabnzbd
2013-11-09 13:07 - 2013-11-12 11:26 - 00000000 ____D C:\Program Files (x86)\SABnzbd
2013-11-08 15:28 - 2013-11-08 15:28 - 00000000 ____D C:\Users\Ersatzuser\Logitech
2013-11-08 15:27 - 2013-11-08 15:27 - 00000000 ____D C:\Program Files (x86)\Logitech
2013-11-06 09:24 - 2013-11-06 09:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-05 11:59 - 2013-10-07 11:45 - 00388912 _____ (DisplayLink Corp.) C:\WINDOWS\system32\Drivers\dlkmd.sys
2013-11-05 11:59 - 2013-10-07 11:45 - 00015664 _____ (DisplayLink Corp.) C:\WINDOWS\system32\Drivers\dlkmdldr.sys
2013-11-05 11:56 - 2013-11-05 11:57 - 00000000 ____D C:\Program Files\DisplayLink Graphics
2013-11-05 11:52 - 2013-11-05 11:52 - 00000000 ____D C:\Program Files\DisplayLink Core Software
2013-11-04 09:36 - 2013-11-04 09:36 - 00000000 ___RD C:\WINDOWS\BrowserChoice
2013-11-04 09:36 - 2013-11-04 09:36 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-11-03 08:32 - 2013-11-03 08:32 - 00000000 ____D C:\Users\Ersatzuser\SystemRequirementsLab
2013-11-03 08:31 - 2013-11-03 08:31 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2013-11-03 08:31 - 2013-11-03 08:31 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2013-11-03 08:31 - 2013-11-03 08:31 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2013-11-03 08:31 - 2013-11-03 08:31 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2013-11-03 08:31 - 2013-11-03 08:31 - 00000000 ____D C:\ProgramData\Sun
2013-11-03 08:31 - 2013-11-03 08:31 - 00000000 ____D C:\ProgramData\Oracle
2013-11-03 08:31 - 2013-11-03 08:31 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-03 08:28 - 2013-11-03 08:28 - 00000000 ____D C:\Program Files (x86)\SystemRequirementsLab
2013-11-02 21:02 - 2013-11-02 21:02 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Intel_Corporation
2013-11-02 20:56 - 2013-11-02 20:56 - 00000017 _____ C:\Users\Ersatzuser\AppData\Local\resmon.resmoncfg
2013-11-02 20:54 - 2013-11-02 20:54 - 00001457 _____ C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-02 20:54 - 2013-11-02 20:54 - 00000020 ___SH C:\Users\Ersatzuser\ntuser.ini
2013-11-02 13:53 - 2013-11-12 11:40 - 01327748 _____ C:\WINDOWS\WindowsUpdate.log
2013-11-02 13:53 - 2013-11-02 13:53 - 00022960 _____ C:\WINDOWS\system32\emptyregdb.dat
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-11-02 13:50 - 2013-11-12 11:27 - 00000000 ____D C:\Users\Ersatzuser
2013-11-02 13:50 - 2013-11-02 13:53 - 00020958 _____ C:\WINDOWS\diagwrn.xml
2013-11-02 13:50 - 2013-11-02 13:53 - 00020958 _____ C:\WINDOWS\diagerr.xml
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Vorlagen
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Startmenü
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Netzwerkumgebung
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Lokale Einstellungen
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Eigene Dateien
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Druckumgebung
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Documents\Eigene Musik
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Documents\Eigene Bilder
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\AppData\Local\Verlauf
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\AppData\Local\Anwendungsdaten
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Anwendungsdaten
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 ___RD C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 ___RD C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 ___RD C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-02 13:48 - 2013-11-02 20:54 - 00000000 ___DC C:\WINDOWS\Panther
2013-11-02 13:48 - 2013-11-02 13:50 - 00000000 ____D C:\ProgramData\Conexant
2013-11-02 13:48 - 2013-11-02 13:50 - 00000000 ____D C:\Program Files\CONEXANT
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_iBtFltCoex_01009.Wdf
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____D C:\Program Files\Elantech
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____D C:\Program Files\AMD
2013-11-02 13:47 - 2013-11-02 13:47 - 23213056 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 17143808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 12995072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 11222016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02763776 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2013-11-02 13:47 - 2013-11-02 13:47 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2013-11-02 13:47 - 2013-11-02 13:47 - 02166272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02144768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01537880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2013-11-02 13:47 - 2013-11-02 13:47 - 01286552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01018960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00977408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00872840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00837120 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00698880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00698232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2013-11-02 13:47 - 2013-11-02 13:47 - 00294400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00262144 _____ C:\WINDOWS\system32\config\userdiff
2013-11-02 13:47 - 2013-11-02 13:47 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files\MSBuild
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-11-02 13:46 - 2013-08-03 05:48 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2013-11-02 13:46 - 2013-08-03 05:48 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2013-11-02 13:46 - 2013-08-03 05:48 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2013-11-02 13:46 - 2013-08-03 05:41 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2013-11-02 13:46 - 2013-08-03 05:41 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-11-02 13:46 - 2013-08-03 05:41 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2013-11-02 13:31 - 2013-11-02 13:53 - 00006602 _____ C:\WINDOWS\comsetup.log
2013-11-02 11:25 - 2013-11-02 13:51 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-11-02 11:25 - 2013-11-02 11:25 - 00001897 _____ C:\Users\Ersatzuser\Desktop\IrfanView Thumbnails.lnk
2013-11-02 11:25 - 2013-11-02 11:25 - 00001009 _____ C:\Users\Ersatzuser\Desktop\IrfanView.lnk
2013-11-02 11:25 - 2013-11-02 11:25 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\IrfanView
2013-11-02 11:25 - 2013-11-02 11:25 - 00000000 ____D C:\Program Files (x86)\IrfanView
2013-10-29 14:32 - 2013-10-31 13:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-29 14:32 - 2013-10-29 14:32 - 00002093 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-10-29 14:32 - 2013-10-29 14:32 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Thunderbird
2013-10-29 14:32 - 2013-10-29 14:32 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Thunderbird
2013-10-28 10:01 - 2013-10-28 10:01 - 00018432 ___SH C:\Users\Ersatzuser\Desktop\Thumbs.db
2013-10-28 09:58 - 2013-10-28 09:58 - 00001081 _____ C:\Users\Public\Desktop\PDF24 Editor.lnk
2013-10-28 09:58 - 2013-10-28 09:58 - 00001066 _____ C:\Users\Public\Desktop\PDF24 Fax.lnk
2013-10-28 09:58 - 2013-10-28 09:58 - 00000000 ____D C:\Program Files (x86)\PDF24
2013-10-27 08:24 - 2013-11-02 20:55 - 00008051 _____ C:\WINDOWS\avmacc.log
2013-10-27 08:23 - 2013-11-02 13:51 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
2013-10-27 08:23 - 2013-10-27 08:23 - 00116480 _____ (AVM Berlin) C:\WINDOWS\system32\Drivers\avmaura.sys
2013-10-25 10:05 - 2013-10-25 10:05 - 00000000 ____D C:\Program Files (x86)\Western Digital Corporation
2013-10-25 08:31 - 2013-10-25 08:31 - 00001875 _____ C:\Users\Ersatzuser\Documents\bee gees.m3u
2013-10-19 08:40 - 2013-10-19 08:40 - 00002060 _____ C:\Users\Public\Desktop\Start Menu 8.lnk
2013-10-18 19:22 - 2013-09-23 12:49 - 00197704 _____ (McAfee, Inc.) C:\WINDOWS\system32\Drivers\HipShieldK.sys
2013-10-16 07:47 - 2013-10-16 07:50 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Mp3tag
2013-10-14 18:59 - 2013-11-12 11:26 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\vlc
2013-10-14 16:21 - 2013-10-14 16:23 - 00000000 ____D C:\Users\Ersatzuser\dwhelper
==================== One Month Modified Files and Folders =======
2013-11-12 11:43 - 2013-11-12 10:56 - 00000000 ____D C:\Users\Ersatzuser\Desktop\scan
2013-11-12 11:41 - 2013-11-12 11:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-12 11:40 - 2013-11-02 13:53 - 01327748 _____ C:\WINDOWS\WindowsUpdate.log
2013-11-12 11:37 - 2013-09-19 09:26 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2767124860-1497693862-2511850011-1001
2013-11-12 11:34 - 2013-09-30 05:14 - 01780340 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-11-12 11:34 - 2013-09-30 04:56 - 00766620 _____ C:\WINDOWS\system32\perfh007.dat
2013-11-12 11:34 - 2013-09-30 04:56 - 00159902 _____ C:\WINDOWS\system32\perfc007.dat
2013-11-12 11:32 - 2013-11-12 11:32 - 00116440 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2013-11-12 11:32 - 2013-09-19 10:02 - 00001863 _____ C:\Users\Public\Desktop\McAfee Security Center.lnk
2013-11-12 11:31 - 2013-11-12 11:31 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2013-11-12 11:30 - 2013-08-22 15:46 - 00292070 _____ C:\WINDOWS\setupact.log
2013-11-12 11:28 - 2013-11-10 09:08 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Deployment
2013-11-12 11:27 - 2013-11-02 13:50 - 00000000 ____D C:\Users\Ersatzuser
2013-11-12 11:27 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-11-12 11:26 - 2013-11-09 13:07 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SABnzbd
2013-11-12 11:26 - 2013-11-09 13:07 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\sabnzbd
2013-11-12 11:26 - 2013-11-09 13:07 - 00000000 ____D C:\Program Files (x86)\SABnzbd
2013-11-12 11:26 - 2013-10-14 18:59 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\vlc
2013-11-12 11:26 - 2013-10-11 09:49 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\pcvisit Software AG
2013-11-12 11:26 - 2013-09-19 10:45 - 00000000 ____D C:\Program Files (x86)\FRITZ!Fernzugang einrichten
2013-11-12 11:26 - 2013-09-19 10:40 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Transmission Remote GUI
2013-11-12 11:26 - 2013-09-19 10:40 - 00000000 ____D C:\Program Files (x86)\Transmission Remote GUI
2013-11-12 11:26 - 2013-09-19 10:39 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Winamp
2013-11-12 11:26 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\WinStore
2013-11-12 11:26 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2013-11-12 11:26 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\registration
2013-11-12 11:26 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Camera
2013-11-12 11:26 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2013-11-12 11:22 - 2013-11-11 21:29 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 8
2013-11-12 11:22 - 2013-11-11 21:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-12 11:17 - 2013-11-12 11:17 - 00000000 ____D C:\FRST
2013-11-12 11:17 - 2013-11-12 11:17 - 00000000 _____ C:\Users\Ersatzuser\defogger_reenable
2013-11-12 11:06 - 2013-09-29 20:04 - 00008092 _____ C:\WINDOWS\PFRO.log
2013-11-12 10:57 - 2013-11-12 10:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-12 09:06 - 2013-10-03 11:45 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\DellUI
2013-11-11 21:31 - 2013-11-11 21:31 - 00000000 ____D C:\WINDOWS\PCHEALTH
2013-11-11 21:31 - 2013-11-11 21:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Sync Framework
2013-11-11 21:31 - 2013-11-11 21:31 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-11-11 21:31 - 2013-11-11 21:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-11-11 21:29 - 2013-11-11 21:29 - 00000000 ____D C:\Program Files\Microsoft Office
2013-11-11 21:29 - 2013-11-11 21:29 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-11-11 21:28 - 2013-11-11 21:28 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Microsoft Help
2013-11-10 19:19 - 2013-11-10 19:19 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\WinRAR
2013-11-10 17:55 - 2013-09-19 11:47 - 00000600 _____ C:\Users\Ersatzuser\AppData\Local\PUTTY.RND
2013-11-09 20:29 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2013-11-09 15:05 - 2013-09-19 11:33 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\FileZilla
2013-11-08 15:28 - 2013-11-08 15:28 - 00000000 ____D C:\Users\Ersatzuser\Logitech
2013-11-08 15:27 - 2013-11-08 15:27 - 00000000 ____D C:\Program Files (x86)\Logitech
2013-11-08 15:27 - 2013-09-19 10:14 - 00009802 _____ C:\WINDOWS\DPINST.LOG
2013-11-07 08:25 - 2013-09-19 10:01 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-11-07 08:25 - 2013-09-19 09:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-06 09:24 - 2013-11-06 09:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-05 11:57 - 2013-11-05 11:56 - 00000000 ____D C:\Program Files\DisplayLink Graphics
2013-11-05 11:52 - 2013-11-05 11:52 - 00000000 ____D C:\Program Files\DisplayLink Core Software
2013-11-05 08:48 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2013-11-04 09:36 - 2013-11-04 09:36 - 00000000 ___RD C:\WINDOWS\BrowserChoice
2013-11-04 09:36 - 2013-11-04 09:36 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2013-11-04 09:36 - 2013-09-19 09:21 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Packages
2013-11-04 09:36 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2013-11-03 08:32 - 2013-11-03 08:32 - 00000000 ____D C:\Users\Ersatzuser\SystemRequirementsLab
2013-11-03 08:31 - 2013-11-03 08:31 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2013-11-03 08:31 - 2013-11-03 08:31 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2013-11-03 08:31 - 2013-11-03 08:31 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2013-11-03 08:31 - 2013-11-03 08:31 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2013-11-03 08:31 - 2013-11-03 08:31 - 00000000 ____D C:\ProgramData\Sun
2013-11-03 08:31 - 2013-11-03 08:31 - 00000000 ____D C:\ProgramData\Oracle
2013-11-03 08:31 - 2013-11-03 08:31 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-03 08:28 - 2013-11-03 08:28 - 00000000 ____D C:\Program Files (x86)\SystemRequirementsLab
2013-11-03 08:27 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\restore
2013-11-03 08:17 - 2013-08-22 15:44 - 00376256 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-11-02 22:20 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2013-11-02 21:02 - 2013-11-02 21:02 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Intel_Corporation
2013-11-02 20:56 - 2013-11-02 20:56 - 00000017 _____ C:\Users\Ersatzuser\AppData\Local\resmon.resmoncfg
2013-11-02 20:55 - 2013-10-27 08:24 - 00008051 _____ C:\WINDOWS\avmacc.log
2013-11-02 20:54 - 2013-11-02 20:54 - 00001457 _____ C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-02 20:54 - 2013-11-02 20:54 - 00000020 ___SH C:\Users\Ersatzuser\ntuser.ini
2013-11-02 20:54 - 2013-11-02 13:48 - 00000000 ___DC C:\WINDOWS\Panther
2013-11-02 20:54 - 2013-09-19 09:21 - 00000000 ___RD C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-02 20:54 - 2013-09-19 09:21 - 00000000 ___RD C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-02 13:53 - 2013-11-02 13:53 - 00022960 _____ C:\WINDOWS\system32\emptyregdb.dat
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-11-02 13:53 - 2013-11-02 13:53 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-11-02 13:53 - 2013-11-02 13:50 - 00020958 _____ C:\WINDOWS\diagwrn.xml
2013-11-02 13:53 - 2013-11-02 13:50 - 00020958 _____ C:\WINDOWS\diagerr.xml
2013-11-02 13:53 - 2013-11-02 13:31 - 00006602 _____ C:\WINDOWS\comsetup.log
2013-11-02 13:53 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Windows NT
2013-11-02 13:53 - 2013-08-22 14:36 - 00000000 __RHD C:\Users\Default
2013-11-02 13:52 - 2013-08-22 16:36 - 00000000 __RSD C:\WINDOWS\Media
2013-11-02 13:52 - 2013-08-22 16:36 - 00000000 __RHD C:\Users\Public\Libraries
2013-11-02 13:51 - 2013-11-02 11:25 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2013-11-02 13:51 - 2013-10-27 08:23 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
2013-11-02 13:51 - 2013-09-30 04:56 - 00000000 ____D C:\WINDOWS\SysWOW64\WCN
2013-11-02 13:51 - 2013-09-30 04:56 - 00000000 ____D C:\WINDOWS\SysWOW64\sysprep
2013-11-02 13:51 - 2013-09-30 04:56 - 00000000 ____D C:\WINDOWS\system32\WCN
2013-11-02 13:51 - 2013-09-20 15:36 - 00000000 ____D C:\WINDOWS\SysWOW64\sda
2013-11-02 13:51 - 2013-09-19 10:46 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRITZ!Fernzugang
2013-11-02 13:51 - 2013-09-19 10:41 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\POP Peeper
2013-11-02 13:51 - 2013-09-19 10:40 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in
2013-11-02 13:51 - 2013-09-19 09:35 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
2013-11-02 13:51 - 2013-09-19 09:34 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe
2013-11-02 13:51 - 2013-08-22 16:37 - 00004893 _____ C:\WINDOWS\DtcInstall.log
2013-11-02 13:51 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\SysWOW64\migwiz
2013-11-02 13:51 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\SysWOW64\IME
2013-11-02 13:51 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2013-11-02 13:51 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\spool
2013-11-02 13:51 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\IME
2013-11-02 13:51 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\SysWOW64\SMI
2013-11-02 13:51 - 2012-07-26 06:37 - 00000000 ____D C:\Users\Default.migrated
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Vorlagen
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Startmenü
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Netzwerkumgebung
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Lokale Einstellungen
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Eigene Dateien
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Druckumgebung
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Documents\Eigene Musik
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Documents\Eigene Bilder
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\AppData\Local\Verlauf
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\AppData\Local\Anwendungsdaten
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 _SHDL C:\Users\Ersatzuser\Anwendungsdaten
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 ___RD C:\Users\Ersatzuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2013-11-02 13:50 - 2013-11-02 13:50 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2013-11-02 13:50 - 2013-11-02 13:48 - 00000000 ____D C:\ProgramData\Conexant
2013-11-02 13:50 - 2013-11-02 13:48 - 00000000 ____D C:\Program Files\CONEXANT
2013-11-02 13:50 - 2013-09-30 04:59 - 00000000 ____D C:\WINDOWS\ShellNew
2013-11-02 13:50 - 2013-09-19 09:21 - 00000000 ____D C:\ProgramData\PRICache
2013-11-02 13:50 - 2013-08-22 16:43 - 00000000 ____D C:\WINDOWS\DigitalLocker
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 __SHD C:\Program Files\Windows Sidebar
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 __SHD C:\Program Files (x86)\Windows Sidebar
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\Recovery
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\IME
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Help
2013-11-02 13:50 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_iBtFltCoex_01009.Wdf
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____D C:\Program Files\Elantech
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2013-11-02 13:48 - 2013-11-02 13:48 - 00000000 ____D C:\Program Files\AMD
2013-11-02 13:48 - 2013-08-22 15:46 - 00000168 _____ C:\WINDOWS\setuperr.log
2013-11-02 13:47 - 2013-11-02 13:47 - 23213056 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 17143808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 12995072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 11222016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02763776 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2013-11-02 13:47 - 2013-11-02 13:47 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2013-11-02 13:47 - 2013-11-02 13:47 - 02166272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02144768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01537880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2013-11-02 13:47 - 2013-11-02 13:47 - 01286552 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 01018960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00977408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00872840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00837120 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00698880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00698232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2013-11-02 13:47 - 2013-11-02 13:47 - 00294400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00262144 _____ C:\WINDOWS\system32\config\userdiff
2013-11-02 13:47 - 2013-11-02 13:47 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2013-11-02 13:47 - 2013-11-02 13:47 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-11-02 13:47 - 2013-08-22 16:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2013-11-02 13:47 - 2013-08-22 16:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-02 13:47 - 2013-08-22 16:36 - 00262144 _____ C:\WINDOWS\system32\config\BCD-Template
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files\MSBuild
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2013-11-02 13:46 - 2013-11-02 13:46 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-11-02 13:46 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI
2013-11-02 13:46 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\MUI
2013-11-02 13:44 - 2013-09-19 09:20 - 02054548 _____ C:\WINDOWS\WindowsUpdate (1).log
2013-11-02 13:19 - 2012-07-26 09:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent
2013-11-02 11:25 - 2013-11-02 11:25 - 00001897 _____ C:\Users\Ersatzuser\Desktop\IrfanView Thumbnails.lnk
2013-11-02 11:25 - 2013-11-02 11:25 - 00001009 _____ C:\Users\Ersatzuser\Desktop\IrfanView.lnk
2013-11-02 11:25 - 2013-11-02 11:25 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\IrfanView
2013-11-02 11:25 - 2013-11-02 11:25 - 00000000 ____D C:\Program Files (x86)\IrfanView
2013-10-31 13:19 - 2013-10-29 14:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 08:35 - 2013-09-19 11:19 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\POP Peeper
2013-10-29 14:32 - 2013-10-29 14:32 - 00002093 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-10-29 14:32 - 2013-10-29 14:32 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Thunderbird
2013-10-29 14:32 - 2013-10-29 14:32 - 00000000 ____D C:\Users\Ersatzuser\AppData\Local\Thunderbird
2013-10-29 13:39 - 2013-09-19 10:41 - 00000000 ____D C:\Program Files (x86)\POP Peeper
2013-10-28 11:48 - 2013-09-19 10:42 - 00000986 _____ C:\Users\Public\Desktop\Mp3tag.lnk
2013-10-28 11:48 - 2013-09-19 10:42 - 00000000 ____D C:\Program Files (x86)\Mp3tag
2013-10-28 10:01 - 2013-10-28 10:01 - 00018432 ___SH C:\Users\Ersatzuser\Desktop\Thumbs.db
2013-10-28 09:58 - 2013-10-28 09:58 - 00001081 _____ C:\Users\Public\Desktop\PDF24 Editor.lnk
2013-10-28 09:58 - 2013-10-28 09:58 - 00001066 _____ C:\Users\Public\Desktop\PDF24 Fax.lnk
2013-10-28 09:58 - 2013-10-28 09:58 - 00000000 ____D C:\Program Files (x86)\PDF24
2013-10-27 08:23 - 2013-10-27 08:23 - 00116480 _____ (AVM Berlin) C:\WINDOWS\system32\Drivers\avmaura.sys
2013-10-25 10:05 - 2013-10-25 10:05 - 00000000 ____D C:\Program Files (x86)\Western Digital Corporation
2013-10-25 08:31 - 2013-10-25 08:31 - 00001875 _____ C:\Users\Ersatzuser\Documents\bee gees.m3u
2013-10-24 16:36 - 2013-10-02 16:02 - 00000405 _____ C:\Users\Ersatzuser\Desktop\Neues Textdokument.txt
2013-10-20 13:40 - 2013-09-27 21:16 - 00000000 ____D C:\Users\Ersatzuser\Desktop\tmp
2013-10-19 08:40 - 2013-10-19 08:40 - 00002060 _____ C:\Users\Public\Desktop\Start Menu 8.lnk
2013-10-19 08:40 - 2013-09-19 09:51 - 00003166 _____ C:\WINDOWS\System32\Tasks\StartMenuAutoupdate
2013-10-18 19:17 - 2013-09-19 09:53 - 00000000 ____D C:\Program Files\Common Files\McAfee
2013-10-18 19:17 - 2012-07-26 09:12 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2013-10-16 07:50 - 2013-10-16 07:47 - 00000000 ____D C:\Users\Ersatzuser\AppData\Roaming\Mp3tag
2013-10-14 16:23 - 2013-10-14 16:21 - 00000000 ____D C:\Users\Ersatzuser\dwhelper
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-12 09:29
==================== End Of Log ============================
--- --- ---
--- --- ---
gmer.txt:
[code]
GMER Logfile: Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-12 11:55:20
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000030 Samsung_SSD_840_EVO_120GB rev.EXT0BB0Q 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Ersatzuser\AppData\Local\Temp\kwliraod.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\atiesrxx.exe[240] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\atiesrxx.exe[240] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\atiesrxx.exe[240] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\atiesrxx.exe[240] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\dwm.exe[508] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\dwm.exe[508] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\dwm.exe[508] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\dwm.exe[508] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[960] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[960] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[960] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[960] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe[1152] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe[1152] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe[1152] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe[1152] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe[1152] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007fff67ac1f6a 4 bytes [AC, 67, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe[1152] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007fff67ac1f82 4 bytes [AC, 67, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe[1244] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe[1244] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe[1244] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe[1244] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\FRITZ!Fernzugang\avmike.exe[1780] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007fff67ac1f6a 4 bytes [AC, 67, FF, 7F]
.text C:\Program Files\FRITZ!Fernzugang\avmike.exe[1780] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007fff67ac1f82 4 bytes [AC, 67, FF, 7F]
.text C:\Program Files\FRITZ!Fernzugang\certsrv.exe[1796] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007fff67ac1f6a 4 bytes [AC, 67, FF, 7F]
.text C:\Program Files\FRITZ!Fernzugang\certsrv.exe[1796] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007fff67ac1f82 4 bytes [AC, 67, FF, 7F]
.text C:\Windows\system32\mfevtps.exe[1948] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\Windows\system32\mfevtps.exe[1948] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\Windows\system32\mfevtps.exe[1948] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\Windows\system32\mfevtps.exe[1948] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe[1988] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007fff67ac1f6a 4 bytes [AC, 67, FF, 7F]
.text C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe[1988] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007fff67ac1f82 4 bytes [AC, 67, FF, 7F]
.text C:\WINDOWS\Explorer.EXE[2904] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\Explorer.EXE[2904] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\Explorer.EXE[2904] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\WINDOWS\Explorer.EXE[2904] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\Windows\System32\igfxpers.exe[3500] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\Windows\System32\igfxpers.exe[3500] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\Windows\System32\igfxpers.exe[3500] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\Windows\System32\igfxpers.exe[3500] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Conexant\SA3\SmartAudio3.exe[4104] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Conexant\SA3\SmartAudio3.exe[4104] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Conexant\SA3\SmartAudio3.exe[4104] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Conexant\SA3\SmartAudio3.exe[4104] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[3624] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007fff6d49169a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[3624] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007fff6d4916a2 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[3624] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007fff6d49181a 4 bytes [49, 6D, FF, 7F]
.text C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe[3624] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007fff6d491832 4 bytes [49, 6D, FF, 7F]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [776:3028] fffff9600093a4d0
Thread C:\WINDOWS\System32\svchost.exe [3960:5224] 00007fff61944b30
Thread C:\WINDOWS\System32\svchost.exe [3960:4048] 00007fff61944b30
Thread C:\WINDOWS\System32\svchost.exe [3960:4288] 00007fff61944b30
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{86E25361-AD98-499A-B258-C70940BA3FFA}\Connection@Name isatap.{C5E18DE8-37AA-45F4-B1E7-9B7519CB9CD4}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 946234428
Reg HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications\Components\TrustedInstaller@Events CreateSession
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\84a6c8b29e3f
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\84a6c8b29e3f@001cefdaf56c 0xC3 0x6C 0x4B 0xBD ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Upgrade\LocalRadioSettings
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Upgrade\LocalRadioSettings\0002
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Upgrade\LocalRadioSettings\0002@BackupContext 0x02 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Upgrade\LocalRadioSettings\0002@Bluetooth_UniqueID {00000000-0000-0000-0000-000000000000}#001CEFDAF56C_00000000
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Upgrade\LocalRadioSettings\0002@ConnectionCount 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{86E25361-AD98-499A-B258-C70940BA3FFA}@InterfaceName isatap.{C5E18DE8-37AA-45F4-B1E7-9B7519CB9CD4}
Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{86E25361-AD98-499A-B258-C70940BA3FFA}@ReusableType 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{86E25361-AD98-499A-B258-C70940BA3FFA}@DefunctTimestamp 0x77 0x02 0x82 0x52 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\rdyboost\Parameters@LastBootPlanUserTime ?Di?, ?Nov ?12 ?13, 11:28:37??????w???????w???????????????w????
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 1524
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 906
Reg HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\3@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\3@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband@FavoritesRemovedChanges 24
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid@PreviousScaleFactor 80
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid@Layout_MaximumAvailableHeightCells 12
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid@Layout_AvailableHeightCells 12
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid@Logo100 %USERPROFILE%\AppData\Local\Microsoft\Windows\Explorer\TileCacheLogo-1366500_100.dat
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013101420131021
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013101420131021@CachePrefix :2013101420131021:
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013101420131021@CachePath %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013101420131021
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013101420131021@CacheOptions 11
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013101420131021@CacheRepair 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013101420131021@CacheLimit 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110420131105
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110420131105@CachePrefix :2013110420131105:
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110420131105@CachePath %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013110420131105
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110420131105@CacheOptions 11
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110420131105@CacheRepair 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110420131105@CacheLimit 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110520131106
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110520131106@CachePrefix :2013110520131106:
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110520131106@CachePath %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013110520131106
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110520131106@CacheOptions 11
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110520131106@CacheRepair 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110520131106@CacheLimit 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110620131107
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110620131107@CachePrefix :2013110620131107:
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110620131107@CachePath %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013110620131107
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110620131107@CacheOptions 11
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110620131107@CacheRepair 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110620131107@CacheLimit 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110720131108
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110720131108@CachePrefix :2013110720131108:
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110720131108@CachePath %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013110720131108
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110720131108@CacheOptions 11
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110720131108@CacheRepair 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110720131108@CacheLimit 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110820131109
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110820131109@CachePrefix :2013110820131109:
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110820131109@CachePath %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012013110820131109
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110820131109@CacheOptions 11
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110820131109@CacheRepair 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013110820131109@CacheLimit 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce@Shockwave Updater "C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1204144.exe" -Update
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Store@LastTileRefresh 0x0A 0xF0 0x07 0x4D ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Store\RefreshBannedAppList@BannedAppsLastModified 0x00 0xCC 0xEC 0xAA ...
Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting@LastQueueNoPesterTime 0x3F 0xED 0x84 0xBA ...
---- EOF - GMER 2.1 ----
--- --- --- |
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
