Google Redirect Virus lässt sich nicht aus dem Netzwerk entfernen und plötzlicher Bluescreen
 

Hi,

Ich werde seit einigen Tagen bei Google-Suchen ungewollt auf dubiose Webseiten umgeleitet (z.B. "URL4Short.info").
Das geschieht allerdings nicht nur auf meinem PC, sondern auch auf unserem Familien-Tablet-PC.
Beide Geräte sind am gleichen privaten WiFi-Netzwerk.

Ich habe bereits folgende Schritt unternommen:

1. Scan mit Security Essentials. Es wurden 2 Bedrohungen gefunden und entfernt. Logfile siehe unten.
2. Scan mit Malwarebytes Anti-Malware. Es wurden 13 weitere Bedrohungen gefunden und entfernt. Logfile siehe unten.
   Ich vermute, dass dort auch viel Adware dabei war, die ich mir auf einer der umgeleiteten Seiten eingefangen habe.
   Zum Schutz hiervor habe ich mir bereits Web of trust in Firefox installiert, die ungewollten Werbebanner sind verschwunden.
3. Ich habe die Tipps in diesem Video: hxxp://www.youtube.com/watch?v=H-YPtErh1t4 befolgt.
   Ich habe mir also die "hosts"-Datei unter System32/drivers/etc angeschaut, dort konnte ich aber keinen zusätzlichen (verdächtigen) Eintrag finden.
   Dann habe ich die "ntbtlog.txt" laut Anleitung erstellt, habe dort aber keinen verdächtigen Eintrag gefunden. "ntbtlog.txt" siehe unten.
4. Ich habe die hier im Forum geforderten Logfiles mit Hilfe der drei Programme erstellt. Logfiles siehe untern.

Komischerweise hatte ich direkt nach dem letzten Schritt einen plötzlichen Bluescreen (ich habe in dem Moment nichts getan), danach lies sich der PC wieder normal starten.
Bis jetzt ist das nicht wieder passiert.
Ich glaube auch mir einzubilden, dass der PC etwas langsamer läuft.

Vielen Dank im Voraus und frohes Neues,
Daniel

--------------Ende des Posts es folgen Logfiles----------------------------

• MPDetection-[...].log (Security Essentials)
  
  Code:

  ---

  2013-12-22T20:09:25.369Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-22T20:09:36.933Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.416.0 AV 1.165.416.0
2013-12-23T10:53:08.623Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-23T10:53:16.184Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.416.0 AV 1.165.416.0
2013-12-24T10:28:57.876Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-24T10:29:02.803Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.470.0 AV 1.165.470.0
2013-12-25T08:59:14.556Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-25T08:59:23.405Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.566.0 AV 1.165.566.0
2013-12-26T15:56:20.667Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-26T15:56:28.486Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.566.0 AV 1.165.566.0
2013-12-27T10:07:20.744Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-27T10:07:31.503Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.634.0 AV 1.165.634.0
2013-12-27T17:08:51.764Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-27T17:08:56.522Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.634.0 AV 1.165.634.0
2013-12-28T08:35:01.892Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-28T08:35:14.047Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.634.0 AV 1.165.634.0
2013-12-28T11:38:48.934Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-28T11:38:59.632Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.755.0 AV 1.165.755.0
2013-12-28T17:12:12.009Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-28T17:12:18.594Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.755.0 AV 1.165.755.0
2013-12-29T09:18:03.979Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-29T09:18:09.178Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.755.0 AV 1.165.755.0
2013-12-29T10:06:45.931Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-29T10:06:54.098Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.787.0 AV 1.165.787.0
2013-12-29T15:30:15.293Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-29T15:30:22.380Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.787.0 AV 1.165.787.0
2013-12-30T09:46:37.759Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-30T09:46:43.669Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.787.0 AV 1.165.787.0
2013-12-30T12:54:29.945Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-30T12:54:37.517Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.822.0 AV 1.165.822.0
2013-12-30T17:17:07.478Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-30T17:17:30.530Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.822.0 AV 1.165.822.0
2013-12-31T10:47:53.648Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-31T10:48:02.790Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.822.0 AV 1.165.822.0
2013-12-31T20:58:22.483Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2013-12-31T20:58:27.070Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.887.0 AV 1.165.887.0
2014-01-01T10:54:58.152Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2014-01-01T10:55:07.653Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.887.0 AV 1.165.887.0
2014-01-01T17:45:47.160Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2014-01-01T17:45:51.819Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.977.0 AV 1.165.977.0
2014-01-01T19:26:58.904Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2014-01-01T19:27:10.819Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.977.0 AV 1.165.977.0
2014-01-01T19:49:06.147Z DETECTION Adware:Win32/FastSaveApp file:C:\$Recycle.Bin\S-1-5-21-3895061128-266478412-1364876304-1000\$RJMGT3N\ikpkdkdpjekaglclmjjgaghjfnmbjegm.crx->manifest.json
2014-01-01T19:49:06.159Z DETECTION Adware:Win32/FastSaveApp file:C:\$Recycle.Bin\S-1-5-21-3895061128-266478412-1364876304-1000\$RJMGT3N\settings.ini
2014-01-01T20:00:33.809Z DETECTION Exploit:Java/CVE-2012-1723 file:C:\Users\Magda\AppData\Local\Temp\jar_cache9051801770020012867.tmp->Cfsdfs77.class
2014-01-01T20:00:38.149Z DETECTION Exploit:Java/CVE-2012-1723 file:C:\Users\Magda\AppData\Local\Temp\jar_cache9051801770020012867.tmp->XTTP.class
2014-01-01T20:37:46.367Z Service stopped with exit code 0x0
2014-01-01T20:38:38.449Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2014-01-01T20:38:43.690Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.977.0 AV 1.165.977.0
2014-01-02T08:19:17.759Z Service started - Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)
2014-01-02T08:19:25.631Z Version: Product 4.4.304.0 Service 4.4.304.0 Engine 1.1.10201.0 AS 1.165.977.0 AV 1.165.977.0

  ---

• mbam-log-[...].txt (MBAM)
  
  Code:

  ---

  Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.01.01.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16750
Juschus :: JUSCHUS-VAIO [administrator]

Protection: Enabled

01/01/2014 20:46:47
mbam-log-2014-01-01 (20-46-47).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 418631
Time elapsed: 50 minute(s), 2 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 2
C:\Users\Juschus\AppData\Local\Temp\CT3203625 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Juschus\AppData\Local\Temp\CT3297931 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

Files Detected: 9
C:\$Recycle.Bin\S-1-5-21-3895061128-266478412-1364876304-1000\$RJMGT3N\uninstall.exe (PUP.Optional.SilentInstall.A) -> Quarantined and deleted successfully.
C:\Users\Daniel\AppData\Local\Temp\JKfR6oor.exe.part (PUP.Optional.Somoto) -> Quarantined and deleted successfully.
C:\Users\Juschus\AppData\Local\Temp\OptimizerPro.exe (PUP.Optional.OptimizePro.A) -> Quarantined and deleted successfully.
C:\Users\Juschus\AppData\Local\Temp\CT3203625\statisticsStub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Juschus\Local Settings\Temporary Internet Files\Content.IE5\OSO3323Z\tonebytes_4929[1].exe (PUP.Optional.InstallMonetizer.A) -> Quarantined and deleted successfully.
C:\Users\Juschus\Local Settings\Temporary Internet Files\Content.IE5\XINL9W75\statisticsstub[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Magda\AppData\Local\Temp\1SKKKKKKK.exe (Exploit.Drop.GS) -> Quarantined and deleted successfully.
C:\Users\Juschus\AppData\Local\Temp\CT3203625\parameters.csf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\Juschus\AppData\Local\Temp\CT3297931\ddt.csf (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

(end)

  ---

• defogger_disable.log (Defogger) (es gab keine Fehlermeldung)
  
  Code:

  ---

  defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:44 on 02/01/2014 (Juschus)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

  ---

• FRST.txt (FRST64)
  
  Code:

  ---

  Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-01-2014 01
Ran by Daniel (ATTENTION: The logged in user is not administrator) on JUSCHUS-VAIO on 02-01-2014 13:45:27
Running from C:\Users\Daniel\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
() C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
(KORG Inc.) C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-07-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-07-20] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [947360 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [797344 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2011-06-22] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1012000 2013-05-16] (NVIDIA Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [500736 2011-05-02] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [2801288 2011-05-31] (Sony Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Reader Library Launcher] - C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [BambooCore] - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [KORG USB-MIDI Driver] - C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe [394248 2013-01-08] (KORG Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1823656 2013-12-11] (Valve Corporation)
HKCU\...\Run: [HP Photosmart 5520 series (NET)] - C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
MountPoints2: {c689b126-9c52-11e2-a115-f0bf97d8419f} - E:\AutoRun.exe
MountPoints2: {c689b163-9c52-11e2-a115-f0bf97d8419f} - E:\AutoRun.exe
MountPoints2: {c689b1ce-9c52-11e2-a115-f0bf97d8419f} - E:\AutoRun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E7914903-6BD3-46C4-9170-66424A6A5837} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {F2183BDB-43CB-43F5-923E-65950E296EC5} URL = hxxp://rover.ebay.com/rover/1/710-42480-16445-33/4?mpre=hxxp://shop.ebay.co.uk/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SaveByclick - {F263F5E4-C485-C3E7-0A30-6E0664620DAF} - C:\ProgramData\SaveByclick\50dc5ae069268.dll No File
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default
FF Homepage: hxxp://de.msn.com/
FF NetworkProxy: "backup.ftp", "188.138.104.221 "
FF NetworkProxy: "backup.ftp_port", 3128
FF NetworkProxy: "backup.socks", "188.138.104.221 "
FF NetworkProxy: "backup.socks_port", 3128
FF NetworkProxy: "backup.ssl", "188.138.104.221 "
FF NetworkProxy: "backup.ssl_port", 3128
FF NetworkProxy: "ftp", "188.138.104.221"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "188.138.104.221"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "188.138.104.221"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "188.138.104.221"
FF NetworkProxy: "ssl_port", 3128
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Daniel\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: Ghostery - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default\Extensions\firefox@ghostery.com.xpi
FF Extension: Adblock Plus - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [ikpkdkdpjekaglclmjjgaghjfnmbjegm] - C:\ProgramData\SaveByclick\ikpkdkdpjekaglclmjjgaghjfnmbjegm.crx

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-07-05] (Atheros)
R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd)
S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd)
S3 DCDhcpService; C:\Program Files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [104096 2011-07-19] (Atheros Communication Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] ()
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MOBK649backup; C:\Program Files (x86)\McAfee Online Backup\MOBK649backup.exe [223544 2011-04-18] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R2 MSSQL$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [40999448 2008-07-10] (Microsoft Corporation)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4737024 2008-07-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)
S2 pr2ah4nb; C:\Windows\system32\pr2ah4nb.exe [777576 2007-07-19] (CODEMASTERS)
S2 pr2ah4nc; C:\Windows\system32\pr2ah4nc.exe [754288 2007-05-18] (CODEMASTERS)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259512 2011-07-22] (Sony Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [369688 2008-07-10] (Microsoft Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-12-11] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2012-01-03] ()
R3 bomebus; C:\Windows\System32\DRIVERS\bomebus.sys [34376 2010-10-12] (Bome Software)
S3 bomemidi; C:\Windows\System32\drivers\bomemidi.sys [30792 2010-10-12] (Bome Software)
S2 CdaC15BA; C:\Windows\SysWow64\drivers\CdaC15BA.SYS [12464 2013-06-08] (Macrovision Europe Ltd)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2012-09-18] (Huawei Technologies Co., Ltd.)
S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUM64.SYS [34288 2013-01-08] (KORG INC.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2012-01-03] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 MOBK649Filter; C:\Windows\System32\DRIVERS\MOBK649.sys [66040 2011-04-18] (Mozy, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R0 pe3ah4nb; C:\Windows\System32\drivers\pe3ah4nb.sys [72296 2007-07-19] (CODEMASTERS)
R0 pe3ah4nc; C:\Windows\System32\drivers\pe3ah4nc.sys [72560 2007-05-18] (CODEMASTERS)
R0 ps6ah4nb; C:\Windows\System32\drivers\ps6ah4nb.sys [102000 2007-07-19] (CODEMASTERS)
R0 ps6ah4nc; C:\Windows\System32\drivers\ps6ah4nc.sys [77176 2007-05-18] (CODEMASTERS)
R2 risdsnpe; C:\Windows\system32\drivers\risdsnxc64.sys [98816 2011-06-23] (REDC)
S3 USBTINSP; C:\Windows\System32\DRIVERS\tinspusb.sys [142848 2012-03-06] (Texas Instruments)
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [x]
S3 wacomvhid; system32\DRIVERS\wacomvhid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-02 13:45 - 2014-01-02 13:45 - 00022783 _____ C:\Users\Daniel\Desktop\FRST.txt
2014-01-02 13:45 - 2014-01-02 13:45 - 00000000 ____D C:\Users\Daniel\Desktop\FRST-OlderVersion
2014-01-02 13:44 - 2014-01-02 13:44 - 00000476 _____ C:\Users\Daniel\Desktop\defogger_disable.log
2014-01-02 11:22 - 2014-01-02 11:22 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-01 22:33 - 2014-01-01 22:33 - 00915368 _____ (Oracle Corporation) C:\Users\Daniel\Downloads\jxpiinstall.exe
2014-01-01 22:16 - 2014-01-02 13:45 - 00000000 ____D C:\FRST
2014-01-01 22:15 - 2014-01-01 22:15 - 00000000 _____ C:\Users\Juschus\defogger_reenable
2014-01-01 22:11 - 2014-01-02 13:45 - 01931426 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2014-01-01 22:11 - 2014-01-01 22:11 - 00377856 _____ C:\Users\Daniel\Desktop\gmer_2.1.19163.exe
2014-01-01 22:11 - 2014-01-01 22:11 - 00050477 _____ C:\Users\Daniel\Desktop\Defogger.exe
2014-01-01 22:08 - 2014-01-01 22:08 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Malwarebytes
2014-01-01 21:54 - 2014-01-01 21:54 - 00388608 _____ (Trend Micro Inc.) C:\Users\Daniel\Downloads\HiJackThis204.exe
2014-01-01 21:54 - 2014-01-01 21:54 - 00019333 _____ C:\Users\Daniel\Downloads\hijackthis.log
2014-01-01 20:48 - 2014-01-01 20:48 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-01-01 20:48 - 2014-01-01 20:48 - 00000000 ____D C:\Program Files\CCleaner
2014-01-01 20:46 - 2014-01-01 20:46 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-01 20:46 - 2014-01-01 20:46 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Malwarebytes
2014-01-01 20:45 - 2014-01-01 20:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-01 20:45 - 2014-01-01 20:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 20:45 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-01 14:50 - 2014-01-01 14:50 - 00002475 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2014-01-01 14:47 - 2014-01-01 14:47 - 00000000 ____D C:\Users\Daniel\Downloads\AS_Airport-Enhancement-Services_V234
2014-01-01 13:51 - 2014-01-01 13:53 - 33146870 _____ C:\Users\Daniel\Downloads\Ursus tractor and trailers v11.zip
2014-01-01 13:49 - 2014-01-01 13:51 - 20036311 _____ C:\Users\Daniel\Downloads\kamaz master v1.2 .zip
2014-01-01 13:49 - 2014-01-01 13:49 - 07091447 _____ C:\Users\Daniel\Downloads\landcruiserhdj80-v1-2.zip
2014-01-01 13:48 - 2014-01-01 13:49 - 10023942 _____ C:\Users\Daniel\Downloads\actros4141.zip
2014-01-01 13:48 - 2014-01-01 13:48 - 02218739 _____ C:\Users\Daniel\Downloads\SchoolBus.zip
2014-01-01 13:47 - 2014-01-01 13:48 - 10502887 _____ C:\Users\Daniel\Downloads\UAZ_2206.zip
2014-01-01 13:41 - 2014-01-01 13:42 - 05014217 _____ C:\Users\Daniel\Downloads\lancer_evo_v2.zip
2014-01-01 13:00 - 2014-01-01 13:00 - 00000000 ____D C:\Users\Daniel\Downloads\krazLog
2014-01-01 12:25 - 2014-01-01 14:43 - 00000000 ____D C:\Users\Daniel\Downloads\STBuild120713Dev
2013-12-31 12:36 - 2013-12-31 12:36 - 00000000 ____D C:\Users\Daniel\Documents\Visual Studio 2008
2013-12-30 16:26 - 2013-12-30 16:26 - 00002879 _____ C:\Users\Juschus\Desktop\Aviation Jargon Speech Trainer.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00002865 _____ C:\Users\Juschus\Desktop\MCE Aerosoft A320-321.lnk
2013-12-30 16:25 - 2013-12-30 16:26 - 00000000 ____D C:\Program Files (x86)\Multi Crew Experience Aerosoft AXA
2013-12-30 16:15 - 2013-12-30 16:15 - 00001744 _____ C:\Users\Public\Desktop\RAAS Pro Aerosoft Info.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001664 _____ C:\Users\Public\Desktop\FS2Crew Airbus X Coupon Code.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001539 _____ C:\Users\Public\Desktop\RAAS Pro Manual.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001524 _____ C:\Users\Public\Desktop\RAAS SDK.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\RAASPRO
2013-12-30 16:14 - 2013-12-30 16:14 - 00000000 ____D C:\Users\Juschus\Documents\Aerosoft
2013-12-28 10:23 - 2013-12-28 10:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-27 13:52 - 2013-12-27 13:54 - 77481330 _____ () C:\Users\Daniel\Downloads\vR_BR103_VRot_DE_EN_V1.exe
2013-12-23 18:22 - 2013-12-23 18:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-12-23 18:08 - 2013-12-23 18:08 - 00000222 _____ C:\Users\Daniel\Desktop\War Thunder.url
2013-12-23 17:24 - 2013-12-23 17:24 - 00000000 ____D C:\Users\Daniel\Documents\My Games
2013-12-23 13:42 - 2013-12-23 13:42 - 00000221 _____ C:\Users\Daniel\Desktop\Audiosurf.url
2013-12-22 14:37 - 2013-12-22 14:37 - 00000000 ____D C:\Users\Daniel\Documents\Flight Simulator X-Dateien
2013-12-21 12:33 - 2013-12-21 12:33 - 00000000 ____D C:\Users\Daniel\ItchySynths_Overdose_Suite
2013-12-21 11:39 - 2011-12-19 13:08 - 02239702 _____ C:\Users\Daniel\Desktop\Demolition Man - erb N dub Drop 2.wav
2013-12-20 12:08 - 2013-12-20 12:08 - 00013653 _____ C:\Users\Daniel\Downloads\file.php
2013-12-20 12:08 - 2013-12-20 12:08 - 00000000 ____D C:\Users\Daniel\Downloads\Projekt_Szczecin
2013-12-19 20:29 - 2013-12-19 20:29 - 00000000 ____D C:\Users\Daniel\Downloads\BVG324
2013-12-19 13:03 - 2013-12-19 13:03 - 00001087 _____ C:\Users\Public\Desktop\OMSI Addon Manager.lnk
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Program Files (x86)\OMSI Addon Manager
2013-12-19 13:02 - 2013-12-19 13:02 - 00000000 ____D C:\Users\Daniel\Downloads\OMSI_AM_1.2.4_Setup
2013-12-19 12:54 - 2013-12-19 12:54 - 00000000 ____D C:\Users\Daniel\Downloads\MAN_NL202-Projekt_Szczecin
2013-12-19 12:52 - 2013-12-19 12:52 - 00000000 ____D C:\Users\Daniel\Downloads\Projekt_Szczecin_3.10_20130110
2013-12-18 14:40 - 2013-12-18 14:40 - 00000222 _____ C:\Users\Daniel\Desktop\OMSI 2.url
2013-12-18 09:45 - 2013-12-18 09:45 - 00001059 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{9D18D848-CED5-4665-9D6C-AC997FC4BCDD}
2013-12-18 09:42 - 2013-12-18 09:42 - 00000000 ____D C:\Users\Daniel\Downloads\Supercharger_110_PC
2013-12-14 13:13 - 2013-12-14 13:14 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-12-13 17:36 - 2013-12-13 17:36 - 00006520 _____ C:\Users\Daniel\.recently-used.xbel
2013-12-11 20:13 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 20:13 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 20:13 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 20:13 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 20:12 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 20:12 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 20:12 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 20:12 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 20:12 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-11 20:12 - 2013-10-25 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 20:12 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 20:12 - 2013-10-25 04:17 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-11 20:12 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-11 14:58 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 14:58 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 14:58 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 14:58 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 14:58 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 14:58 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 14:58 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 14:58 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 14:58 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 14:57 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 14:57 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 14:57 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 14:57 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 14:57 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 14:57 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 14:57 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 14:57 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 14:57 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 14:57 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-07 12:04 - 2013-12-07 12:08 - 00000000 ____D C:\Users\Daniel\AppData\Local\HP
2013-12-07 12:03 - 2013-12-07 12:03 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\Visan
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-07 12:01 - 2013-12-07 12:01 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\HpUpdate
2013-12-07 12:01 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMB111.dll
2013-12-07 11:59 - 2013-12-07 12:01 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-07 11:59 - 2013-12-07 11:59 - 00000000 ____D C:\ProgramData\HP
2013-12-07 11:57 - 2013-12-07 11:57 - 00000057 _____ C:\ProgramData\Ament.ini
2013-12-07 11:57 - 2013-12-07 11:57 - 00000000 ____D C:\Program Files\HP
2013-12-05 19:26 - 2013-12-05 19:26 - 08923288 _____ C:\Users\Juschus\Desktop\vuex6493.exe
2013-12-03 08:26 - 2013-12-03 08:26 - 00000000 ____D C:\ProgramData\Qualcomm Atheros

==================== One Month Modified Files and Folders =======

2014-01-02 13:45 - 2014-01-02 13:45 - 00022783 _____ C:\Users\Daniel\Desktop\FRST.txt
2014-01-02 13:45 - 2014-01-02 13:45 - 00000000 ____D C:\Users\Daniel\Desktop\FRST-OlderVersion
2014-01-02 13:45 - 2014-01-01 22:16 - 00000000 ____D C:\FRST
2014-01-02 13:45 - 2014-01-01 22:11 - 01931426 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2014-01-02 13:44 - 2014-01-02 13:44 - 00000476 _____ C:\Users\Daniel\Desktop\defogger_disable.log
2014-01-02 13:41 - 2011-12-24 13:16 - 00000000 ____D C:\Users\Daniel\AppData\Local\CrashDumps
2014-01-02 13:32 - 2013-10-28 18:22 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-02 13:25 - 2012-03-21 17:33 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Skype
2014-01-02 13:21 - 2011-12-23 15:42 - 01472247 _____ C:\Windows\WindowsUpdate.log
2014-01-02 13:20 - 2012-08-23 13:13 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-02 12:27 - 2009-07-14 05:51 - 00287406 _____ C:\Windows\setupact.log
2014-01-02 11:22 - 2014-01-02 11:22 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-02 11:22 - 2013-07-30 17:11 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-02 11:22 - 2012-08-23 13:13 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-02 09:27 - 2009-07-14 05:45 - 00020928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-02 09:27 - 2009-07-14 05:45 - 00020928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-02 09:19 - 2011-08-25 04:52 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-02 09:19 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-01 22:33 - 2014-01-01 22:33 - 00915368 _____ (Oracle Corporation) C:\Users\Daniel\Downloads\jxpiinstall.exe
2014-01-01 22:15 - 2014-01-01 22:15 - 00000000 _____ C:\Users\Juschus\defogger_reenable
2014-01-01 22:15 - 2011-12-23 15:42 - 00000000 ____D C:\Users\Juschus
2014-01-01 22:11 - 2014-01-01 22:11 - 00377856 _____ C:\Users\Daniel\Desktop\gmer_2.1.19163.exe
2014-01-01 22:11 - 2014-01-01 22:11 - 00050477 _____ C:\Users\Daniel\Desktop\Defogger.exe
2014-01-01 22:08 - 2014-01-01 22:08 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Malwarebytes
2014-01-01 21:54 - 2014-01-01 21:54 - 00388608 _____ (Trend Micro Inc.) C:\Users\Daniel\Downloads\HiJackThis204.exe
2014-01-01 21:54 - 2014-01-01 21:54 - 00019333 _____ C:\Users\Daniel\Downloads\hijackthis.log
2014-01-01 21:44 - 2009-07-14 06:13 - 00876932 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 21:38 - 2010-11-21 04:47 - 00325236 _____ C:\Windows\PFRO.log
2014-01-01 20:48 - 2014-01-01 20:48 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-01-01 20:48 - 2014-01-01 20:48 - 00000000 ____D C:\Program Files\CCleaner
2014-01-01 20:46 - 2014-01-01 20:46 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-01 20:46 - 2014-01-01 20:46 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Malwarebytes
2014-01-01 20:46 - 2014-01-01 20:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-01 20:45 - 2014-01-01 20:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 20:25 - 2011-12-23 15:43 - 00000000 ____D C:\Windows\pss
2014-01-01 20:14 - 2011-12-23 15:45 - 00000000 ____D C:\Users\Juschus\Documents\Bluetooth Folder
2014-01-01 20:13 - 2013-11-11 19:28 - 00000000 ____D C:\Users\Daniel\Documents\Bluetooth Folder
2014-01-01 18:46 - 2009-07-14 06:08 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-01 14:50 - 2014-01-01 14:50 - 00002475 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2014-01-01 14:47 - 2014-01-01 14:47 - 00000000 ____D C:\Users\Daniel\Downloads\AS_Airport-Enhancement-Services_V234
2014-01-01 14:43 - 2014-01-01 12:25 - 00000000 ____D C:\Users\Daniel\Downloads\STBuild120713Dev
2014-01-01 14:43 - 2012-01-14 13:15 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\SpinTires
2014-01-01 13:53 - 2014-01-01 13:51 - 33146870 _____ C:\Users\Daniel\Downloads\Ursus tractor and trailers v11.zip
2014-01-01 13:51 - 2014-01-01 13:49 - 20036311 _____ C:\Users\Daniel\Downloads\kamaz master v1.2 .zip
2014-01-01 13:49 - 2014-01-01 13:49 - 07091447 _____ C:\Users\Daniel\Downloads\landcruiserhdj80-v1-2.zip
2014-01-01 13:49 - 2014-01-01 13:48 - 10023942 _____ C:\Users\Daniel\Downloads\actros4141.zip
2014-01-01 13:48 - 2014-01-01 13:48 - 02218739 _____ C:\Users\Daniel\Downloads\SchoolBus.zip
2014-01-01 13:48 - 2014-01-01 13:47 - 10502887 _____ C:\Users\Daniel\Downloads\UAZ_2206.zip
2014-01-01 13:42 - 2014-01-01 13:41 - 05014217 _____ C:\Users\Daniel\Downloads\lancer_evo_v2.zip
2014-01-01 13:00 - 2014-01-01 13:00 - 00000000 ____D C:\Users\Daniel\Downloads\krazLog
2013-12-31 17:12 - 2013-09-29 18:55 - 00000000 ____D C:\Users\Juschus\Documents\Flight Simulator X-Dateien
2013-12-31 12:36 - 2013-12-31 12:36 - 00000000 ____D C:\Users\Daniel\Documents\Visual Studio 2008
2013-12-30 18:20 - 2011-12-23 15:52 - 00151152 _____ C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-30 18:17 - 2009-07-14 05:45 - 00638504 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-30 16:26 - 2013-12-30 16:26 - 00002879 _____ C:\Users\Juschus\Desktop\Aviation Jargon Speech Trainer.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00002865 _____ C:\Users\Juschus\Desktop\MCE Aerosoft A320-321.lnk
2013-12-30 16:26 - 2013-12-30 16:25 - 00000000 ____D C:\Program Files (x86)\Multi Crew Experience Aerosoft AXA
2013-12-30 16:17 - 2011-08-25 05:48 - 00325427 _____ C:\Windows\DirectX.log
2013-12-30 16:15 - 2013-12-30 16:15 - 00001744 _____ C:\Users\Public\Desktop\RAAS Pro Aerosoft Info.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001664 _____ C:\Users\Public\Desktop\FS2Crew Airbus X Coupon Code.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001539 _____ C:\Users\Public\Desktop\RAAS Pro Manual.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001524 _____ C:\Users\Public\Desktop\RAAS SDK.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\RAASPRO
2013-12-30 16:14 - 2013-12-30 16:14 - 00000000 ____D C:\Users\Juschus\Documents\Aerosoft
2013-12-30 15:21 - 2011-12-23 15:52 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Atheros
2013-12-29 10:37 - 2012-04-18 14:14 - 00000000 ____D C:\Users\Daniel\Documents\FFOutput
2013-12-28 12:38 - 2012-09-12 15:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-28 10:23 - 2013-12-28 10:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-27 13:54 - 2013-12-27 13:52 - 77481330 _____ () C:\Users\Daniel\Downloads\vR_BR103_VRot_DE_EN_V1.exe
2013-12-23 18:34 - 2013-03-25 13:39 - 00000000 ____D C:\ProgramData\WarThunder
2013-12-23 18:22 - 2013-12-23 18:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-12-23 18:08 - 2013-12-23 18:08 - 00000222 _____ C:\Users\Daniel\Desktop\War Thunder.url
2013-12-23 18:07 - 2013-03-25 11:50 - 00000000 ____D C:\Users\Daniel\AppData\Local\War Thunder
2013-12-23 17:24 - 2013-12-23 17:24 - 00000000 ____D C:\Users\Daniel\Documents\My Games
2013-12-23 13:42 - 2013-12-23 13:42 - 00000221 _____ C:\Users\Daniel\Desktop\Audiosurf.url
2013-12-22 14:37 - 2013-12-22 14:37 - 00000000 ____D C:\Users\Daniel\Documents\Flight Simulator X-Dateien
2013-12-21 17:43 - 2013-06-19 13:21 - 00000000 ____D C:\Users\Daniel\Documents\Fl Studio Collection
2013-12-21 16:07 - 2013-06-24 16:44 - 00000000 ____D C:\Program Files (x86)\VstPlugins
2013-12-21 12:34 - 2011-12-23 15:51 - 00000000 ____D C:\Users\Daniel
2013-12-21 12:33 - 2013-12-21 12:33 - 00000000 ____D C:\Users\Daniel\ItchySynths_Overdose_Suite
2013-12-20 12:08 - 2013-12-20 12:08 - 00013653 _____ C:\Users\Daniel\Downloads\file.php
2013-12-20 12:08 - 2013-12-20 12:08 - 00000000 ____D C:\Users\Daniel\Downloads\Projekt_Szczecin
2013-12-19 20:29 - 2013-12-19 20:29 - 00000000 ____D C:\Users\Daniel\Downloads\BVG324
2013-12-19 13:03 - 2013-12-19 13:03 - 00001087 _____ C:\Users\Public\Desktop\OMSI Addon Manager.lnk
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Program Files (x86)\OMSI Addon Manager
2013-12-19 13:02 - 2013-12-19 13:02 - 00000000 ____D C:\Users\Daniel\Downloads\OMSI_AM_1.2.4_Setup
2013-12-19 12:54 - 2013-12-19 12:54 - 00000000 ____D C:\Users\Daniel\Downloads\MAN_NL202-Projekt_Szczecin
2013-12-19 12:52 - 2013-12-19 12:52 - 00000000 ____D C:\Users\Daniel\Downloads\Projekt_Szczecin_3.10_20130110
2013-12-18 14:40 - 2013-12-18 14:40 - 00000222 _____ C:\Users\Daniel\Desktop\OMSI 2.url
2013-12-18 10:34 - 2012-01-25 15:47 - 00224335 _____ C:\test.xml
2013-12-18 09:50 - 2013-11-09 12:03 - 00000000 ____D C:\Users\Daniel\Documents\Native Instruments
2013-12-18 09:45 - 2013-12-18 09:45 - 00001059 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{9D18D848-CED5-4665-9D6C-AC997FC4BCDD}
2013-12-18 09:45 - 2013-06-25 15:26 - 00000000 ____D C:\Program Files\Common Files\Native Instruments
2013-12-18 09:45 - 2013-06-25 15:21 - 00000000 ____D C:\Program Files\Native Instruments
2013-12-18 09:42 - 2013-12-18 09:42 - 00000000 ____D C:\Users\Daniel\Downloads\Supercharger_110_PC
2013-12-16 15:37 - 2012-11-11 15:36 - 00000000 ____D C:\Users\Daniel\Documents\Kindergarten
2013-12-15 19:02 - 2012-04-18 14:04 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 14:03 - 2013-07-29 19:19 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 14:00 - 2012-05-31 17:35 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-14 13:14 - 2013-12-14 13:13 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-12-13 17:36 - 2013-12-13 17:36 - 00006520 _____ C:\Users\Daniel\.recently-used.xbel
2013-12-12 16:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-11 17:32 - 2012-03-30 19:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 17:32 - 2011-08-25 05:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 15:08 - 2013-04-29 20:03 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-12-07 15:14 - 2013-10-03 18:32 - 00052736 ___SH C:\Users\Daniel\Documents\Thumbs.db
2013-12-07 12:08 - 2013-12-07 12:04 - 00000000 ____D C:\Users\Daniel\AppData\Local\HP
2013-12-07 12:03 - 2013-12-07 12:03 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\Visan
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-07 12:01 - 2013-12-07 12:01 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\HpUpdate
2013-12-07 12:01 - 2013-12-07 11:59 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-07 11:59 - 2013-12-07 11:59 - 00000000 ____D C:\ProgramData\HP
2013-12-07 11:57 - 2013-12-07 11:57 - 00000057 _____ C:\ProgramData\Ament.ini
2013-12-07 11:57 - 2013-12-07 11:57 - 00000000 ____D C:\Program Files\HP
2013-12-05 19:33 - 2011-08-25 04:50 - 00037132 _____ C:\Windows\DPINST.LOG
2013-12-05 19:26 - 2013-12-05 19:26 - 08923288 _____ C:\Users\Juschus\Desktop\vuex6493.exe
2013-12-03 08:27 - 2011-08-25 04:46 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-03 08:26 - 2013-12-03 08:26 - 00000000 ____D C:\ProgramData\Qualcomm Atheros
2013-12-03 08:26 - 2011-12-23 15:46 - 00000000 ____D C:\Update

Some content of TEMP:
====================
C:\Users\Daniel\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\Daniel\AppData\Local\Temp\HOST10852.exe
C:\Users\Daniel\AppData\Local\Temp\HOST5228.exe
C:\Users\Daniel\AppData\Local\Temp\LauncherYRFreeskiIISetup.exe
C:\Users\Daniel\AppData\Local\Temp\nokiabahn1.exe
C:\Users\Daniel\AppData\Local\Temp\SIntf16.dll
C:\Users\Daniel\AppData\Local\Temp\SIntf32.dll
C:\Users\Daniel\AppData\Local\Temp\SIntfNT.dll
C:\Users\Daniel\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Daniel\AppData\Local\Temp\TINspireStudent-3.1.0.392.exe
C:\Users\Daniel\AppData\Local\Temp\ubi276F.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubi3322.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubi785B.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubi91FB.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubi9EF1.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubiB9DE.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubiD78.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubiEC05.tmp.exe
C:\Users\Daniel\AppData\Local\Temp\ubiFB02.tmp.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

  ---

-------------------------Die maximale Länge des Posts wurde überschritten, ich hänge die restlichen Logfiles (Addition.txt und gmer.txt) laut Anleitung als "Anhang" an diesen Post dran.---------------

Hallo und :hallo:

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

[EDIT]: Es tut sich nun doch etwas, mal sehen, ob es klappt!

Danke für die Begrüßung und die schnelle Antwort!

Ich habe gerade versucht Combofix auszuführen.
Der Installationsprozess und das Backup der Registry durchlaufen problemlos, dann aber schließt sich Combofix und nichts weiteres passiert.
Ich habe es mal mit dem Task-Manager beobachtet, der Prozess combofix.exe schließt sich sofort, sobald der grüne Balken am Ende angekommen ist.

Die Real-Time-Protection in Security Essentials habe ich abgeschaltet, und bei der Trial-Version von MBAM ist die sowieso nicht dabei.
Muss ich noch irgendein anderes Programm abschalten?

Hat nun doch geklappt mit Combofix.
Beim Neustart gab es keine Fehlermeldung.

Allerdings hat Combofix 36 GB an Daten gelöscht, ich hoffe, da war nichts wichtiges dabei...

Hier ist die combofix.txt:

Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Bis jetzt hatte ich keine Probleme mehr, sieht so aus, als wäre es weg!

Vielen Dank! :daumenhoc

• AdwCleaner[S0].txt (adwCleaner):
  
  Code:

  ---

  # AdwCleaner v3.016 - Report created 03/01/2014 at 18:09:10
# Updated 23/12/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Juschus - JUSCHUS-VAIO
# Running from : C:\Users\Daniel\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\NCH Software
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveByclick
Folder Deleted : C:\Users\Daniel\AppData\Roaming\NCH Software
Folder Deleted : C:\Users\Magda\AppData\LocalLow\SaveByclick
File Deleted : C:\Windows\System32\Tasks\LaunchApp
File Deleted : C:\Windows\System32\Tasks\NCH Software

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FSX - McDonnell Douglas MD-11F UPS_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_dj-promixer_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_dj-promixer_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_openbve_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_openbve_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_screenhunter_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_screenhunter_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_simutrans_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_simutrans_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_zulu-dj_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_zulu-dj_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\Software\DeviceVM
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26B5A6D1-1F75-3B59-5825-E4D4CAE3445D}
Key Deleted : [x64] HKLM\SOFTWARE\Description
Key Deleted : [x64] HKLM\SOFTWARE\DeviceVM

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16750


-\\ Mozilla Firefox v26.0 (de)

[ File : C:\Users\Juschus\AppData\Roaming\Mozilla\Firefox\Profiles\qd1qav5j.default\prefs.js ]

Line Deleted : user_pref("extensions.50dc5ae069184.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};(function(){if(window.self==window.top&&!document.getElementById('shk85shs[...]

[ File : C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default\prefs.js ]


[ File : C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\w9n4ov7i.default\prefs.js ]


[ File : C:\Users\Magda\AppData\Roaming\Mozilla\Firefox\Profiles\411kskja.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [4432 octets] - [03/01/2014 18:07:52]
AdwCleaner[S0].txt - [4268 octets] - [03/01/2014 18:09:10]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [4328 octets] ##########

  ---

• JRT.txt (JRT):
  
  Code:

  ---

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.9 (01.01.2014:1)
OS: Windows 7 Home Premium x64
Ran by Juschus on 03/01/2014 at 18:15:28.36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F263F5E4-C485-C3E7-0A30-6E0664620DAF}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F263F5E4-C485-C3E7-0A30-6E0664620DAF}



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Juschus\AppData\Roaming\mozilla\firefox\profiles\qd1qav5j.default\minidumps [20 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03/01/2014 at 18:21:33.31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ---

• FRST.txt (FRST):
  
  FRST Logfile:
  
  FRST Logfile:
  
  Code:

  ---

  Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2014
Ran by Daniel (ATTENTION: The logged in user is not administrator) on JUSCHUS-VAIO on 03-01-2014 18:50:31
Running from C:\Users\Daniel\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
() C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
(KORG Inc.) C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicator.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-07-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-07-20] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [947360 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [797344 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2011-06-22] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1012000 2013-05-16] (NVIDIA Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [500736 2011-05-02] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [2801288 2011-05-31] (Sony Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Reader Library Launcher] - C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [BambooCore] - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [KORG USB-MIDI Driver] - C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe [394248 2013-01-08] (KORG Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1823656 2013-12-11] (Valve Corporation)
HKCU\...\Run: [HP Photosmart 5520 series (NET)] - C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
MountPoints2: {c689b126-9c52-11e2-a115-f0bf97d8419f} - E:\AutoRun.exe
MountPoints2: {c689b163-9c52-11e2-a115-f0bf97d8419f} - E:\AutoRun.exe
MountPoints2: {c689b1ce-9c52-11e2-a115-f0bf97d8419f} - E:\AutoRun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E7914903-6BD3-46C4-9170-66424A6A5837} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {F2183BDB-43CB-43F5-923E-65950E296EC5} URL = hxxp://rover.ebay.com/rover/1/710-42480-16445-33/4?mpre=hxxp://shop.ebay.co.uk/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Daniel\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: Ghostery - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default\Extensions\firefox@ghostery.com.xpi
FF Extension: Adblock Plus - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\sc4e3n6i.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Docs) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [ikpkdkdpjekaglclmjjgaghjfnmbjegm] - C:\ProgramData\SaveByclick\ikpkdkdpjekaglclmjjgaghjfnmbjegm.crx

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-07-05] (Atheros)
R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd)
S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd)
S3 DCDhcpService; C:\Program Files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [104096 2011-07-19] (Atheros Communication Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] ()
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MOBK649backup; C:\Program Files (x86)\McAfee Online Backup\MOBK649backup.exe [223544 2011-04-18] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R2 MSSQL$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [40999448 2008-07-10] (Microsoft Corporation)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4737024 2008-07-29] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)
S2 pr2ah4nb; C:\Windows\system32\pr2ah4nb.exe [777576 2007-07-19] (CODEMASTERS)
S2 pr2ah4nc; C:\Windows\system32\pr2ah4nc.exe [754288 2007-05-18] (CODEMASTERS)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259512 2011-07-22] (Sony Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [369688 2008-07-10] (Microsoft Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-12-11] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2012-01-03] ()
R3 bomebus; C:\Windows\System32\DRIVERS\bomebus.sys [34376 2010-10-12] (Bome Software)
S3 bomemidi; C:\Windows\System32\drivers\bomemidi.sys [30792 2010-10-12] (Bome Software)
S2 CdaC15BA; C:\Windows\SysWow64\drivers\CdaC15BA.SYS [12464 2013-06-08] (Macrovision Europe Ltd)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2012-09-18] (Huawei Technologies Co., Ltd.)
S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUM64.SYS [34288 2013-01-08] (KORG INC.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2012-01-03] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 MOBK649Filter; C:\Windows\System32\DRIVERS\MOBK649.sys [66040 2011-04-18] (Mozy, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R0 pe3ah4nb; C:\Windows\System32\drivers\pe3ah4nb.sys [72296 2007-07-19] (CODEMASTERS)
R0 pe3ah4nc; C:\Windows\System32\drivers\pe3ah4nc.sys [72560 2007-05-18] (CODEMASTERS)
R0 ps6ah4nb; C:\Windows\System32\drivers\ps6ah4nb.sys [102000 2007-07-19] (CODEMASTERS)
R0 ps6ah4nc; C:\Windows\System32\drivers\ps6ah4nc.sys [77176 2007-05-18] (CODEMASTERS)
R2 risdsnpe; C:\Windows\system32\drivers\risdsnxc64.sys [98816 2011-06-23] (REDC)
S3 USBTINSP; C:\Windows\System32\DRIVERS\tinspusb.sys [142848 2012-03-06] (Texas Instruments)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [x]
S3 wacomvhid; system32\DRIVERS\wacomvhid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-03 18:50 - 2014-01-03 18:50 - 00021501 _____ C:\Users\Daniel\Desktop\FRST.txt
2014-01-03 18:49 - 2014-01-03 18:49 - 00001034 _____ C:\Users\Daniel\Desktop\JRT.txt
2014-01-03 18:48 - 2014-01-03 18:48 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-03 18:21 - 2014-01-03 18:21 - 00001034 _____ C:\Users\Juschus\Desktop\JRT.txt
2014-01-03 18:15 - 2014-01-03 18:15 - 00000000 ____D C:\Windows\ERUNT
2014-01-03 18:09 - 2014-01-03 18:09 - 00004422 _____ C:\Users\Daniel\Desktop\AdwCleaner[S0].txt
2014-01-03 18:07 - 2014-01-03 18:49 - 00000000 ____D C:\AdwCleaner
2014-01-03 18:06 - 2014-01-03 18:06 - 01036305 _____ (Thisisu) C:\Users\Daniel\Desktop\JRT.exe
2014-01-03 18:05 - 2014-01-03 18:05 - 01233962 _____ C:\Users\Daniel\Desktop\adwcleaner.exe
2014-01-02 18:53 - 2014-01-02 18:53 - 00000222 _____ C:\Users\Daniel\Desktop\OMSI 2.url
2014-01-02 16:36 - 2014-01-02 16:36 - 00051090 _____ C:\ComboFix.txt
2014-01-02 16:01 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-02 16:01 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-02 16:01 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-02 15:42 - 2014-01-02 15:42 - 00000381 _____ C:\Users\Daniel\Desktop\combofixfail.txt
2014-01-02 15:32 - 2014-01-02 15:21 - 05160282 ____R (Swearware) C:\Users\Juschus\Desktop\ComboFix.exe
2014-01-02 15:24 - 2014-01-02 16:36 - 00000000 ____D C:\Qoobox
2014-01-02 15:24 - 2014-01-02 16:34 - 00000000 ____D C:\Windows\erdnt
2014-01-02 15:02 - 2014-01-02 15:02 - 00013506 _____ C:\Users\Daniel\Desktop\Logfiles.zip
2014-01-02 14:51 - 2014-01-02 14:51 - 00000000 ____D C:\Program Files (x86)\7-Zip
2014-01-02 14:29 - 2014-01-02 14:52 - 00060654 _____ C:\Users\Daniel\Desktop\trojanerboardredirect1.txt
2014-01-02 14:13 - 2014-01-02 14:13 - 809872641 _____ C:\Windows\MEMORY.DMP
2014-01-02 14:13 - 2014-01-02 14:13 - 00000000 ____D C:\Windows\Minidump
2014-01-02 14:06 - 2014-01-02 14:06 - 00008478 _____ C:\Users\Daniel\Desktop\gmer.txt
2014-01-02 13:54 - 2014-01-01 23:00 - 18432780 _____ C:\Users\Daniel\Desktop\MPLog-12262011-171356.log
2014-01-02 13:54 - 2014-01-01 23:00 - 00012116 _____ C:\Users\Daniel\Desktop\MPDetection-12222013-210925.log
2014-01-02 13:45 - 2014-01-03 18:50 - 00000000 ____D C:\Users\Daniel\Desktop\FRST-OlderVersion
2014-01-02 13:44 - 2014-01-02 13:44 - 00000476 _____ C:\Users\Daniel\Desktop\defogger_disable.log
2014-01-01 22:16 - 2014-01-03 18:50 - 00000000 ____D C:\FRST
2014-01-01 22:15 - 2014-01-01 22:15 - 00000000 _____ C:\Users\Juschus\defogger_reenable
2014-01-01 22:11 - 2014-01-03 18:50 - 01931750 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2014-01-01 22:11 - 2014-01-01 22:11 - 00377856 _____ C:\Users\Daniel\Desktop\gmer_2.1.19163.exe
2014-01-01 22:11 - 2014-01-01 22:11 - 00050477 _____ C:\Users\Daniel\Desktop\Defogger.exe
2014-01-01 22:08 - 2014-01-01 22:08 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Malwarebytes
2014-01-01 20:46 - 2014-01-01 20:46 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-01 20:46 - 2014-01-01 20:46 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Malwarebytes
2014-01-01 20:45 - 2014-01-01 20:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-01 20:45 - 2014-01-01 20:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 20:45 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-01 14:50 - 2014-01-01 14:50 - 00002475 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2014-01-01 13:51 - 2014-01-01 13:53 - 33146870 _____ C:\Users\Daniel\Downloads\Ursus tractor and trailers v11.zip
2014-01-01 13:49 - 2014-01-01 13:51 - 20036311 _____ C:\Users\Daniel\Downloads\kamaz master v1.2 .zip
2014-01-01 13:49 - 2014-01-01 13:49 - 07091447 _____ C:\Users\Daniel\Downloads\landcruiserhdj80-v1-2.zip
2014-01-01 13:48 - 2014-01-01 13:49 - 10023942 _____ C:\Users\Daniel\Downloads\actros4141.zip
2014-01-01 13:48 - 2014-01-01 13:48 - 02218739 _____ C:\Users\Daniel\Downloads\SchoolBus.zip
2014-01-01 13:47 - 2014-01-01 13:48 - 10502887 _____ C:\Users\Daniel\Downloads\UAZ_2206.zip
2014-01-01 13:41 - 2014-01-01 13:42 - 05014217 _____ C:\Users\Daniel\Downloads\lancer_evo_v2.zip
2014-01-01 12:25 - 2014-01-01 14:43 - 00000000 ____D C:\Users\Daniel\Downloads\STBuild120713Dev
2013-12-31 12:36 - 2013-12-31 12:36 - 00000000 ____D C:\Users\Daniel\Documents\Visual Studio 2008
2013-12-30 16:26 - 2013-12-30 16:26 - 00002879 _____ C:\Users\Juschus\Desktop\Aviation Jargon Speech Trainer.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00002865 _____ C:\Users\Juschus\Desktop\MCE Aerosoft A320-321.lnk
2013-12-30 16:25 - 2013-12-30 16:26 - 00000000 ____D C:\Program Files (x86)\Multi Crew Experience Aerosoft AXA
2013-12-30 16:15 - 2013-12-30 16:15 - 00001744 _____ C:\Users\Public\Desktop\RAAS Pro Aerosoft Info.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001664 _____ C:\Users\Public\Desktop\FS2Crew Airbus X Coupon Code.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001539 _____ C:\Users\Public\Desktop\RAAS Pro Manual.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001524 _____ C:\Users\Public\Desktop\RAAS SDK.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\RAASPRO
2013-12-30 16:14 - 2013-12-30 16:14 - 00000000 ____D C:\Users\Juschus\Documents\Aerosoft
2013-12-28 10:23 - 2013-12-28 10:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-27 13:52 - 2013-12-27 13:54 - 77481330 _____ () C:\Users\Daniel\Downloads\vR_BR103_VRot_DE_EN_V1.exe
2013-12-23 18:22 - 2013-12-23 18:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-12-23 18:08 - 2013-12-23 18:08 - 00000222 _____ C:\Users\Daniel\Desktop\War Thunder.url
2013-12-23 17:24 - 2013-12-23 17:24 - 00000000 ____D C:\Users\Daniel\Documents\My Games
2013-12-23 13:42 - 2013-12-23 13:42 - 00000221 _____ C:\Users\Daniel\Desktop\Audiosurf.url
2013-12-22 14:37 - 2013-12-22 14:37 - 00000000 ____D C:\Users\Daniel\Documents\Flight Simulator X-Dateien
2013-12-21 12:33 - 2013-12-21 12:33 - 00000000 ____D C:\Users\Daniel\ItchySynths_Overdose_Suite
2013-12-21 11:39 - 2011-12-19 13:08 - 02239702 _____ C:\Users\Daniel\Desktop\Demolition Man - erb N dub Drop 2.wav
2013-12-20 12:08 - 2013-12-20 12:08 - 00013653 _____ C:\Users\Daniel\Downloads\file.php
2013-12-19 13:03 - 2013-12-19 13:03 - 00001087 _____ C:\Users\Public\Desktop\OMSI Addon Manager.lnk
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Program Files (x86)\OMSI Addon Manager
2013-12-18 09:45 - 2013-12-18 09:45 - 00001059 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{9D18D848-CED5-4665-9D6C-AC997FC4BCDD}
2013-12-14 13:13 - 2013-12-14 13:14 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-12-13 17:36 - 2013-12-13 17:36 - 00006520 _____ C:\Users\Daniel\.recently-used.xbel
2013-12-11 20:13 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 20:13 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 20:13 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 20:13 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 20:12 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 20:12 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 20:12 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 20:12 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 20:12 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-11 20:12 - 2013-10-25 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 20:12 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 20:12 - 2013-10-25 04:17 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-11 20:12 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-11 14:58 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 14:58 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 14:58 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 14:58 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 14:58 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 14:58 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 14:58 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 14:58 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 14:58 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 14:57 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 14:57 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 14:57 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 14:57 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 14:57 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 14:57 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 14:57 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 14:57 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 14:57 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 14:57 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-07 12:04 - 2013-12-07 12:08 - 00000000 ____D C:\Users\Daniel\AppData\Local\HP
2013-12-07 12:03 - 2013-12-07 12:03 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\Visan
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-07 12:01 - 2013-12-07 12:01 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\HpUpdate
2013-12-07 12:01 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMB111.dll
2013-12-07 11:59 - 2013-12-07 12:01 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-07 11:59 - 2013-12-07 11:59 - 00000000 ____D C:\ProgramData\HP
2013-12-07 11:57 - 2013-12-07 11:57 - 00000057 _____ C:\ProgramData\Ament.ini
2013-12-07 11:57 - 2013-12-07 11:57 - 00000000 ____D C:\Program Files\HP
2013-12-05 19:26 - 2013-12-05 19:26 - 08923288 _____ C:\Users\Juschus\Desktop\vuex6493.exe

==================== One Month Modified Files and Folders =======

2014-01-03 18:51 - 2014-01-03 18:50 - 00021501 _____ C:\Users\Daniel\Desktop\FRST.txt
2014-01-03 18:50 - 2014-01-02 13:45 - 00000000 ____D C:\Users\Daniel\Desktop\FRST-OlderVersion
2014-01-03 18:50 - 2014-01-01 22:16 - 00000000 ____D C:\FRST
2014-01-03 18:50 - 2014-01-01 22:11 - 01931750 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2014-01-03 18:49 - 2014-01-03 18:49 - 00001034 _____ C:\Users\Daniel\Desktop\JRT.txt
2014-01-03 18:49 - 2014-01-03 18:07 - 00000000 ____D C:\AdwCleaner
2014-01-03 18:48 - 2014-01-03 18:48 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-03 18:48 - 2013-10-28 18:22 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-03 18:48 - 2013-07-30 17:11 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-03 18:48 - 2012-08-23 13:13 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-03 18:48 - 2011-12-23 15:42 - 01592665 _____ C:\Windows\WindowsUpdate.log
2014-01-03 18:21 - 2014-01-03 18:21 - 00001034 _____ C:\Users\Juschus\Desktop\JRT.txt
2014-01-03 18:18 - 2009-07-14 05:45 - 00020928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-03 18:18 - 2009-07-14 05:45 - 00020928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-03 18:15 - 2014-01-03 18:15 - 00000000 ____D C:\Windows\ERUNT
2014-01-03 18:10 - 2011-08-25 04:52 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-03 18:10 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-03 18:10 - 2009-07-14 05:51 - 00287742 _____ C:\Windows\setupact.log
2014-01-03 18:09 - 2014-01-03 18:09 - 00004422 _____ C:\Users\Daniel\Desktop\AdwCleaner[S0].txt
2014-01-03 18:07 - 2011-12-24 13:16 - 00000000 ____D C:\Users\Daniel\AppData\Local\CrashDumps
2014-01-03 18:06 - 2014-01-03 18:06 - 01036305 _____ (Thisisu) C:\Users\Daniel\Desktop\JRT.exe
2014-01-03 18:05 - 2014-01-03 18:05 - 01233962 _____ C:\Users\Daniel\Desktop\adwcleaner.exe
2014-01-03 18:00 - 2012-08-23 13:13 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-03 17:32 - 2010-11-21 04:47 - 00326598 _____ C:\Windows\PFRO.log
2014-01-02 18:53 - 2014-01-02 18:53 - 00000222 _____ C:\Users\Daniel\Desktop\OMSI 2.url
2014-01-02 17:44 - 2012-03-21 17:33 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Skype
2014-01-02 17:43 - 2011-12-23 15:42 - 00000000 ____D C:\Users\Juschus
2014-01-02 17:41 - 2011-12-23 16:20 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2014-01-02 17:41 - 2011-08-25 04:46 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2014-01-02 17:38 - 2013-04-29 17:11 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\DVDVideoSoft
2014-01-02 17:38 - 2012-06-27 12:14 - 00000000 ____D C:\Program Files (x86)\Freemake
2014-01-02 16:36 - 2014-01-02 16:36 - 00051090 _____ C:\ComboFix.txt
2014-01-02 16:36 - 2014-01-02 15:24 - 00000000 ____D C:\Qoobox
2014-01-02 16:36 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-02 16:34 - 2014-01-02 15:24 - 00000000 ____D C:\Windows\erdnt
2014-01-02 16:31 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-02 15:42 - 2014-01-02 15:42 - 00000381 _____ C:\Users\Daniel\Desktop\combofixfail.txt
2014-01-02 15:34 - 2013-11-11 19:28 - 00000000 ____D C:\Users\Daniel\Documents\Bluetooth Folder
2014-01-02 15:21 - 2014-01-02 15:32 - 05160282 ____R (Swearware) C:\Users\Juschus\Desktop\ComboFix.exe
2014-01-02 15:02 - 2014-01-02 15:02 - 00013506 _____ C:\Users\Daniel\Desktop\Logfiles.zip
2014-01-02 15:02 - 2011-12-23 15:51 - 00000000 ____D C:\Users\Daniel
2014-01-02 14:52 - 2014-01-02 14:29 - 00060654 _____ C:\Users\Daniel\Desktop\trojanerboardredirect1.txt
2014-01-02 14:51 - 2014-01-02 14:51 - 00000000 ____D C:\Program Files (x86)\7-Zip
2014-01-02 14:13 - 2014-01-02 14:13 - 809872641 _____ C:\Windows\MEMORY.DMP
2014-01-02 14:13 - 2014-01-02 14:13 - 00000000 ____D C:\Windows\Minidump
2014-01-02 14:06 - 2014-01-02 14:06 - 00008478 _____ C:\Users\Daniel\Desktop\gmer.txt
2014-01-02 13:44 - 2014-01-02 13:44 - 00000476 _____ C:\Users\Daniel\Desktop\defogger_disable.log
2014-01-01 23:00 - 2014-01-02 13:54 - 18432780 _____ C:\Users\Daniel\Desktop\MPLog-12262011-171356.log
2014-01-01 23:00 - 2014-01-02 13:54 - 00012116 _____ C:\Users\Daniel\Desktop\MPDetection-12222013-210925.log
2014-01-01 22:15 - 2014-01-01 22:15 - 00000000 _____ C:\Users\Juschus\defogger_reenable
2014-01-01 22:11 - 2014-01-01 22:11 - 00377856 _____ C:\Users\Daniel\Desktop\gmer_2.1.19163.exe
2014-01-01 22:11 - 2014-01-01 22:11 - 00050477 _____ C:\Users\Daniel\Desktop\Defogger.exe
2014-01-01 22:08 - 2014-01-01 22:08 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Malwarebytes
2014-01-01 21:44 - 2009-07-14 06:13 - 00876932 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 20:46 - 2014-01-01 20:46 - 00001069 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-01 20:46 - 2014-01-01 20:46 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Malwarebytes
2014-01-01 20:46 - 2014-01-01 20:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-01 20:45 - 2014-01-01 20:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 20:25 - 2011-12-23 15:43 - 00000000 ____D C:\Windows\pss
2014-01-01 20:14 - 2011-12-23 15:45 - 00000000 ____D C:\Users\Juschus\Documents\Bluetooth Folder
2014-01-01 18:46 - 2009-07-14 06:08 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-01 14:50 - 2014-01-01 14:50 - 00002475 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2014-01-01 14:43 - 2014-01-01 12:25 - 00000000 ____D C:\Users\Daniel\Downloads\STBuild120713Dev
2014-01-01 14:43 - 2012-01-14 13:15 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\SpinTires
2014-01-01 13:53 - 2014-01-01 13:51 - 33146870 _____ C:\Users\Daniel\Downloads\Ursus tractor and trailers v11.zip
2014-01-01 13:51 - 2014-01-01 13:49 - 20036311 _____ C:\Users\Daniel\Downloads\kamaz master v1.2 .zip
2014-01-01 13:49 - 2014-01-01 13:49 - 07091447 _____ C:\Users\Daniel\Downloads\landcruiserhdj80-v1-2.zip
2014-01-01 13:49 - 2014-01-01 13:48 - 10023942 _____ C:\Users\Daniel\Downloads\actros4141.zip
2014-01-01 13:48 - 2014-01-01 13:48 - 02218739 _____ C:\Users\Daniel\Downloads\SchoolBus.zip
2014-01-01 13:48 - 2014-01-01 13:47 - 10502887 _____ C:\Users\Daniel\Downloads\UAZ_2206.zip
2014-01-01 13:42 - 2014-01-01 13:41 - 05014217 _____ C:\Users\Daniel\Downloads\lancer_evo_v2.zip
2013-12-31 17:12 - 2013-09-29 18:55 - 00000000 ____D C:\Users\Juschus\Documents\Flight Simulator X-Dateien
2013-12-31 12:36 - 2013-12-31 12:36 - 00000000 ____D C:\Users\Daniel\Documents\Visual Studio 2008
2013-12-30 18:20 - 2011-12-23 15:52 - 00151152 _____ C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-30 18:17 - 2009-07-14 05:45 - 00638504 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-30 16:26 - 2013-12-30 16:26 - 00002879 _____ C:\Users\Juschus\Desktop\Aviation Jargon Speech Trainer.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00002865 _____ C:\Users\Juschus\Desktop\MCE Aerosoft A320-321.lnk
2013-12-30 16:26 - 2013-12-30 16:25 - 00000000 ____D C:\Program Files (x86)\Multi Crew Experience Aerosoft AXA
2013-12-30 16:17 - 2011-08-25 05:48 - 00325427 _____ C:\Windows\DirectX.log
2013-12-30 16:15 - 2013-12-30 16:15 - 00001744 _____ C:\Users\Public\Desktop\RAAS Pro Aerosoft Info.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001664 _____ C:\Users\Public\Desktop\FS2Crew Airbus X Coupon Code.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001539 _____ C:\Users\Public\Desktop\RAAS Pro Manual.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001524 _____ C:\Users\Public\Desktop\RAAS SDK.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\RAASPRO
2013-12-30 16:14 - 2013-12-30 16:14 - 00000000 ____D C:\Users\Juschus\Documents\Aerosoft
2013-12-30 15:21 - 2011-12-23 15:52 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Atheros
2013-12-29 10:37 - 2012-04-18 14:14 - 00000000 ____D C:\Users\Daniel\Documents\FFOutput
2013-12-28 12:38 - 2012-09-12 15:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-28 10:23 - 2013-12-28 10:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-27 13:54 - 2013-12-27 13:52 - 77481330 _____ () C:\Users\Daniel\Downloads\vR_BR103_VRot_DE_EN_V1.exe
2013-12-23 18:34 - 2013-03-25 13:39 - 00000000 ____D C:\ProgramData\WarThunder
2013-12-23 18:22 - 2013-12-23 18:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-12-23 18:08 - 2013-12-23 18:08 - 00000222 _____ C:\Users\Daniel\Desktop\War Thunder.url
2013-12-23 18:07 - 2013-03-25 11:50 - 00000000 ____D C:\Users\Daniel\AppData\Local\War Thunder
2013-12-23 17:24 - 2013-12-23 17:24 - 00000000 ____D C:\Users\Daniel\Documents\My Games
2013-12-23 13:42 - 2013-12-23 13:42 - 00000221 _____ C:\Users\Daniel\Desktop\Audiosurf.url
2013-12-22 14:37 - 2013-12-22 14:37 - 00000000 ____D C:\Users\Daniel\Documents\Flight Simulator X-Dateien
2013-12-21 17:43 - 2013-06-19 13:21 - 00000000 ____D C:\Users\Daniel\Documents\Fl Studio Collection
2013-12-21 16:07 - 2013-06-24 16:44 - 00000000 ____D C:\Program Files (x86)\VstPlugins
2013-12-21 12:33 - 2013-12-21 12:33 - 00000000 ____D C:\Users\Daniel\ItchySynths_Overdose_Suite
2013-12-20 12:08 - 2013-12-20 12:08 - 00013653 _____ C:\Users\Daniel\Downloads\file.php
2013-12-19 13:03 - 2013-12-19 13:03 - 00001087 _____ C:\Users\Public\Desktop\OMSI Addon Manager.lnk
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Program Files (x86)\OMSI Addon Manager
2013-12-18 10:34 - 2012-01-25 15:47 - 00224335 _____ C:\test.xml
2013-12-18 09:50 - 2013-11-09 12:03 - 00000000 ____D C:\Users\Daniel\Documents\Native Instruments
2013-12-18 09:45 - 2013-12-18 09:45 - 00001059 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{9D18D848-CED5-4665-9D6C-AC997FC4BCDD}
2013-12-18 09:45 - 2013-06-25 15:26 - 00000000 ____D C:\Program Files\Common Files\Native Instruments
2013-12-18 09:45 - 2013-06-25 15:21 - 00000000 ____D C:\Program Files\Native Instruments
2013-12-16 15:37 - 2012-11-11 15:36 - 00000000 ____D C:\Users\Daniel\Documents\Kindergarten
2013-12-15 19:02 - 2012-04-18 14:04 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 14:03 - 2013-07-29 19:19 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 14:00 - 2012-05-31 17:35 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-14 13:14 - 2013-12-14 13:13 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-12-13 17:36 - 2013-12-13 17:36 - 00006520 _____ C:\Users\Daniel\.recently-used.xbel
2013-12-12 16:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-11 17:32 - 2012-03-30 19:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 17:32 - 2011-08-25 05:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 15:08 - 2013-04-29 20:03 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-12-07 15:14 - 2013-10-03 18:32 - 00052736 ___SH C:\Users\Daniel\Documents\Thumbs.db
2013-12-07 12:08 - 2013-12-07 12:04 - 00000000 ____D C:\Users\Daniel\AppData\Local\HP
2013-12-07 12:03 - 2013-12-07 12:03 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\Visan
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-07 12:01 - 2013-12-07 12:01 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\HpUpdate
2013-12-07 12:01 - 2013-12-07 11:59 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-07 11:59 - 2013-12-07 11:59 - 00000000 ____D C:\ProgramData\HP
2013-12-07 11:57 - 2013-12-07 11:57 - 00000057 _____ C:\ProgramData\Ament.ini
2013-12-07 11:57 - 2013-12-07 11:57 - 00000000 ____D C:\Program Files\HP
2013-12-05 19:33 - 2011-08-25 04:50 - 00037132 _____ C:\Windows\DPINST.LOG
2013-12-05 19:26 - 2013-12-05 19:26 - 08923288 _____ C:\Users\Juschus\Desktop\vuex6493.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

  ---

  --- --- ---
  
  --- --- ---
  

Du hast FRST nicht als Admin ausgeführt :(
FRST neu runterladen, starten per Rechtsklick => als Admin ausführen. Haken setzen bei additions und auf Scan klicken, beide Logs in CODE-Tags posten

Neuer Versuch als Administrator:

• FRST.txt:
  
  FRST Logfile:
  
  FRST Logfile:
  
  Code:

  ---

  Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by Juschus (administrator) on JUSCHUS-VAIO on 04-01-2014 12:55:53
Running from C:\Users\Daniel\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Online Backup\MOBK649backup.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
() C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
(KORG Inc.) C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Online Backup\MOBK649backup.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-07-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-07-20] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [947360 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [797344 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2011-06-22] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [497648 2010-07-29] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1012000 2013-05-16] (NVIDIA Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [500736 2011-05-02] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [2801288 2011-05-31] (Sony Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Reader Library Launcher] - C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [BambooCore] - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [KORG USB-MIDI Driver] - C:\Program Files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe [394248 2013-01-08] (KORG Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKCU\...\Run: [SoftAuto.exe] - C:\Program Files (x86)\Creative\Software Update 3\SoftAuto.exe [405504 2008-08-13] (Creative Technology Ltd)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
HKCU\...\Run: [Wisdom-soft ScreenHunter 5.1 Free] - 0
HKU\Magda\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2013-01-16] (Hewlett-Packard Company)
Startup: C:\Users\Juschus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OMSI Addon Manager.lnk
ShortcutTarget: OMSI Addon Manager.lnk -> C:\Program Files (x86)\OMSI Addon Manager\OMSI Addon Manager.exe (Jan Kiesewalter)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://vaioportal.sony.eu
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {3E2C4E63-9A5B-4F99-BF65-8C1B527A91D8} URL = hxxp://rover.ebay.com/rover/1/710-42480-16445-33/4?mpre=hxxp://shop.ebay.co.uk/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
SearchScopes: HKCU - {5051439F-68AA-415C-A6C7-02365397DD95} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Juschus\AppData\Roaming\Mozilla\Firefox\Profiles\qd1qav5j.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @protectdisc.com/NPPDLicenseHelper - C:\Users\Juschus\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Juschus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-07-05] (Atheros)
R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd)
S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd)
S3 DCDhcpService; C:\Program Files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [104096 2011-07-19] (Atheros Communication Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] ()
R2 MOBK649backup; C:\Program Files (x86)\McAfee Online Backup\MOBK649backup.exe [223544 2011-04-18] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R2 MSSQL$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [40999448 2008-07-10] (Microsoft Corporation)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4737024 2008-07-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)
S2 pr2ah4nb; C:\Windows\system32\pr2ah4nb.exe [777576 2007-07-19] (CODEMASTERS)
S2 pr2ah4nc; C:\Windows\system32\pr2ah4nc.exe [754288 2007-05-18] (CODEMASTERS)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259512 2011-07-22] (Sony Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [369688 2008-07-10] (Microsoft Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-12-11] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2012-01-03] ()
R3 bomebus; C:\Windows\System32\DRIVERS\bomebus.sys [34376 2010-10-12] (Bome Software)
S3 bomemidi; C:\Windows\System32\drivers\bomemidi.sys [30792 2010-10-12] (Bome Software)
S2 CdaC15BA; C:\Windows\SysWow64\drivers\CdaC15BA.SYS [12464 2013-06-08] (Macrovision Europe Ltd)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2012-09-18] (Huawei Technologies Co., Ltd.)
S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUM64.SYS [34288 2013-01-08] (KORG INC.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2012-01-03] ()
R1 MOBK649Filter; C:\Windows\System32\DRIVERS\MOBK649.sys [66040 2011-04-18] (Mozy, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R0 pe3ah4nb; C:\Windows\System32\drivers\pe3ah4nb.sys [72296 2007-07-19] (CODEMASTERS)
R0 pe3ah4nc; C:\Windows\System32\drivers\pe3ah4nc.sys [72560 2007-05-18] (CODEMASTERS)
R0 ps6ah4nb; C:\Windows\System32\drivers\ps6ah4nb.sys [102000 2007-07-19] (CODEMASTERS)
R0 ps6ah4nc; C:\Windows\System32\drivers\ps6ah4nc.sys [77176 2007-05-18] (CODEMASTERS)
R2 risdsnpe; C:\Windows\system32\drivers\risdsnxc64.sys [98816 2011-06-23] (REDC)
S3 USBTINSP; C:\Windows\System32\DRIVERS\tinspusb.sys [142848 2012-03-06] (Texas Instruments)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 wacommousefilter; system32\DRIVERS\wacommousefilter.sys [x]
S3 wacomvhid; system32\DRIVERS\wacomvhid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-04 12:55 - 2014-01-04 12:56 - 00024128 _____ C:\Users\Daniel\Desktop\FRST.txt
2014-01-04 12:55 - 2014-01-04 12:55 - 01931368 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2014-01-04 12:09 - 2014-01-04 12:09 - 04182497 _____ C:\Users\Daniel\Downloads\Radikal-Guru-feat_-Rankin-Scroo--My-Trees.zip
2014-01-04 09:38 - 2014-01-04 09:38 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-04 09:32 - 2014-01-04 09:32 - 00000000 ____D C:\Users\Magda\AppData\Local\{779DEC04-3FE6-4871-914C-AD96B270A916}
2014-01-04 09:31 - 2014-01-04 09:31 - 00000000 ___RD C:\Users\Magda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-04 08:49 - 2014-01-04 08:49 - 00000000 ___RD C:\Users\Frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-03 19:39 - 2014-01-03 19:39 - 00000222 _____ C:\Users\Daniel\Desktop\OMSI 2.url
2014-01-03 18:21 - 2014-01-03 18:21 - 00001034 _____ C:\Users\Juschus\Desktop\JRT.txt
2014-01-03 18:15 - 2014-01-03 18:15 - 00000000 ____D C:\Windows\ERUNT
2014-01-03 18:07 - 2014-01-03 18:49 - 00000000 ____D C:\AdwCleaner
2014-01-02 16:36 - 2014-01-02 16:36 - 00051090 _____ C:\ComboFix.txt
2014-01-02 16:01 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-02 16:01 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-02 16:01 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-02 16:01 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-02 15:32 - 2014-01-02 15:21 - 05160282 ____R (Swearware) C:\Users\Juschus\Desktop\ComboFix.exe
2014-01-02 15:31 - 2014-01-02 15:31 - 00000000 ___RD C:\Users\Juschus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-02 15:24 - 2014-01-02 16:36 - 00000000 ____D C:\Qoobox
2014-01-02 15:24 - 2014-01-02 16:34 - 00000000 ____D C:\Windows\erdnt
2014-01-02 14:51 - 2014-01-02 14:51 - 00000000 ____D C:\Program Files (x86)\7-Zip
2014-01-02 14:13 - 2014-01-02 14:14 - 00290536 _____ C:\Windows\Minidump\010214-25521-01.dmp
2014-01-02 14:13 - 2014-01-02 14:13 - 809872641 _____ C:\Windows\MEMORY.DMP
2014-01-02 14:13 - 2014-01-02 14:13 - 00000000 ____D C:\Windows\Minidump
2014-01-02 09:36 - 2014-01-02 09:36 - 00000000 ____D C:\Users\Magda\AppData\Local\{6FE5E739-57CF-422C-BAAA-42F96BE6380F}
2014-01-01 22:16 - 2014-01-03 18:50 - 00000000 ____D C:\FRST
2014-01-01 22:15 - 2014-01-01 22:15 - 00000000 _____ C:\Users\Juschus\defogger_reenable
2014-01-01 22:08 - 2014-01-01 22:08 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Malwarebytes
2014-01-01 20:47 - 2014-01-01 20:47 - 04645232 _____ (Piriform Ltd) C:\Users\Juschus\Downloads\ccsetup409.exe
2014-01-01 20:46 - 2014-01-01 20:46 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Malwarebytes
2014-01-01 20:45 - 2014-01-01 20:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Juschus\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-01 20:45 - 2014-01-01 20:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 20:43 - 2014-01-01 20:43 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Juschus\Downloads\tdsskiller.exe
2014-01-01 14:50 - 2014-01-01 14:50 - 00002475 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2014-01-01 13:51 - 2014-01-01 13:53 - 33146870 _____ C:\Users\Daniel\Downloads\Ursus tractor and trailers v11.zip
2014-01-01 13:49 - 2014-01-01 13:51 - 20036311 _____ C:\Users\Daniel\Downloads\kamaz master v1.2 .zip
2014-01-01 13:49 - 2014-01-01 13:49 - 07091447 _____ C:\Users\Daniel\Downloads\landcruiserhdj80-v1-2.zip
2014-01-01 13:48 - 2014-01-01 13:49 - 10023942 _____ C:\Users\Daniel\Downloads\actros4141.zip
2014-01-01 13:48 - 2014-01-01 13:48 - 02218739 _____ C:\Users\Daniel\Downloads\SchoolBus.zip
2014-01-01 13:47 - 2014-01-01 13:48 - 10502887 _____ C:\Users\Daniel\Downloads\UAZ_2206.zip
2014-01-01 13:41 - 2014-01-01 13:42 - 05014217 _____ C:\Users\Daniel\Downloads\lancer_evo_v2.zip
2014-01-01 12:25 - 2014-01-01 14:43 - 00000000 ____D C:\Users\Daniel\Downloads\STBuild120713Dev
2013-12-31 12:36 - 2013-12-31 12:36 - 00000000 ____D C:\Users\Daniel\Documents\Visual Studio 2008
2013-12-30 16:26 - 2013-12-30 16:26 - 00002879 _____ C:\Users\Juschus\Desktop\Aviation Jargon Speech Trainer.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00002865 _____ C:\Users\Juschus\Desktop\MCE Aerosoft A320-321.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Multi Crew Experience
2013-12-30 16:25 - 2013-12-30 16:26 - 00000000 ____D C:\Program Files (x86)\Multi Crew Experience Aerosoft AXA
2013-12-30 16:15 - 2013-12-30 16:15 - 00001744 _____ C:\Users\Public\Desktop\RAAS Pro Aerosoft Info.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001664 _____ C:\Users\Public\Desktop\FS2Crew Airbus X Coupon Code.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001539 _____ C:\Users\Public\Desktop\RAAS Pro Manual.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001524 _____ C:\Users\Public\Desktop\RAAS SDK.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\RAASPRO
2013-12-30 16:14 - 2013-12-30 16:14 - 00000000 ____D C:\Users\Juschus\Documents\Aerosoft
2013-12-30 11:39 - 2013-12-30 11:39 - 00000000 ____D C:\Users\Magda\AppData\Local\{5D20C2E2-D23D-424B-B0E5-72B077043D94}
2013-12-29 11:08 - 2013-12-29 11:08 - 00000000 ____D C:\Users\Magda\AppData\Local\{315761DA-B359-4760-A5E0-69B906108EE2}
2013-12-28 11:34 - 2013-12-28 11:34 - 00000000 ____D C:\Users\Magda\AppData\Local\{90DBF805-FF59-4916-9744-33CACB76D788}
2013-12-28 10:23 - 2013-12-28 10:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-27 13:52 - 2013-12-27 13:54 - 77481330 _____ () C:\Users\Daniel\Downloads\vR_BR103_VRot_DE_EN_V1.exe
2013-12-27 11:09 - 2013-12-27 11:10 - 00000000 ____D C:\Users\Magda\AppData\Local\{CC6C0AA9-EB09-43FE-BC35-2291B8781A5A}
2013-12-25 09:42 - 2013-12-25 09:42 - 00001292 _____ C:\Users\Magda\Downloads\Koma.acsm
2013-12-25 09:40 - 2013-12-25 09:40 - 00000000 ____D C:\Users\Magda\AppData\Local\{6EEB3E0F-CD1C-4443-B7B5-36C03E55DDC7}
2013-12-23 19:01 - 2013-12-23 19:02 - 00000000 ____D C:\Users\Magda\AppData\Local\{F300B308-5EED-4E18-9A9F-A407904E9B63}
2013-12-23 18:22 - 2013-12-23 18:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-12-23 18:08 - 2013-12-23 18:08 - 00000222 _____ C:\Users\Daniel\Desktop\War Thunder.url
2013-12-23 17:24 - 2013-12-23 17:24 - 00000000 ____D C:\Users\Daniel\Documents\My Games
2013-12-23 13:42 - 2013-12-23 13:42 - 00000221 _____ C:\Users\Daniel\Desktop\Audiosurf.url
2013-12-22 14:37 - 2013-12-22 14:37 - 00000000 ____D C:\Users\Daniel\Documents\Flight Simulator X-Dateien
2013-12-22 10:15 - 2013-12-22 10:15 - 00000000 ____D C:\Users\Magda\AppData\Local\{62FBD19E-EA73-4512-BF0D-3C5D917ADDE6}
2013-12-21 12:33 - 2013-12-21 12:33 - 00000000 ____D C:\Users\Daniel\ItchySynths_Overdose_Suite
2013-12-20 15:06 - 2013-12-20 15:07 - 00000000 ____D C:\Users\Magda\AppData\Local\{C5FF207E-7C26-413B-B478-94F3567DE37D}
2013-12-20 12:08 - 2013-12-20 12:08 - 00013653 _____ C:\Users\Daniel\Downloads\file.php
2013-12-19 15:41 - 2013-12-19 15:41 - 00000000 ____D C:\Users\Magda\AppData\Local\{04C22749-51A5-4E01-804A-7E397374B263}
2013-12-19 13:03 - 2013-12-19 13:03 - 00001087 _____ C:\Users\Public\Desktop\OMSI Addon Manager.lnk
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Users\Juschus\AppData\Local\OMSI AM
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Program Files (x86)\OMSI Addon Manager
2013-12-18 16:25 - 2013-12-18 16:26 - 00000000 ____D C:\Users\Magda\AppData\Local\{B1D7BD16-8A09-4645-A223-C0BB30840CC8}
2013-12-18 09:45 - 2013-12-18 09:45 - 00001059 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{9D18D848-CED5-4665-9D6C-AC997FC4BCDD}
2013-12-17 19:21 - 2013-12-17 19:21 - 00000000 ____D C:\Users\Magda\AppData\Local\{B999B746-3469-4828-AAF5-7C2855259D9F}
2013-12-16 17:17 - 2013-12-16 17:17 - 00000000 ____D C:\Users\Magda\AppData\Local\{1C6A5EDA-C090-40FF-9794-3F1AA8D6A800}
2013-12-15 10:29 - 2013-12-15 10:29 - 00000000 ____D C:\Users\Magda\AppData\Local\{7C388C7A-3E0D-4142-8648-7D2E6B320611}
2013-12-14 13:15 - 2013-12-14 13:15 - 00000000 ____D C:\Users\Magda\AppData\Local\{B16A09D2-BAFB-4761-8038-1BFABD532C2C}
2013-12-14 13:13 - 2013-12-14 13:14 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-12-14 11:51 - 2013-12-14 11:51 - 00000000 ____D C:\Users\Magda\AppData\Local\{6AF4FDA7-7A98-47EE-9CEB-8FD47E3C3E9C}
2013-12-13 17:36 - 2013-12-13 17:36 - 00006520 _____ C:\Users\Daniel\.recently-used.xbel
2013-12-13 15:20 - 2013-12-13 15:21 - 00000000 ____D C:\Users\Magda\AppData\Local\{F97DC64B-6D75-4794-88F8-90E2A3174C2F}
2013-12-12 14:37 - 2013-12-12 14:37 - 00000000 ____D C:\Users\Magda\AppData\Local\{73B0FD03-1077-4945-BE13-D7FF872E4AF8}
2013-12-11 20:13 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 20:13 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 20:13 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-11 20:13 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 20:12 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 20:12 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 20:12 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 20:12 - 2013-10-25 07:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 20:12 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-11 20:12 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-11 20:12 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-11 20:12 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-11 20:12 - 2013-10-25 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 20:12 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-11 20:12 - 2013-10-25 04:17 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-11 20:12 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-11 15:55 - 2013-12-11 15:56 - 00000000 ____D C:\Users\Magda\AppData\Local\{5F228F4F-C961-4A5C-99C5-5AB4C4C3ECDF}
2013-12-11 14:58 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 14:58 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 14:58 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 14:58 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 14:58 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 14:58 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 14:58 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 14:58 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 14:58 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 14:57 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 14:57 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 14:57 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 14:57 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 14:57 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 14:57 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 14:57 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 14:57 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 14:57 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 14:57 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-10 11:04 - 2013-12-10 11:05 - 00000000 ____D C:\Users\Magda\AppData\Local\{A6AD93B5-74D2-4E80-B2AA-B392D250CA0C}
2013-12-09 15:25 - 2013-12-09 15:25 - 00000000 ____D C:\Users\Magda\AppData\Local\{E54230C9-C039-488E-A949-0E0A330CDE43}
2013-12-08 18:59 - 2013-12-08 18:59 - 00000000 ____D C:\Users\Magda\AppData\Local\{C65EFBE5-86F3-419F-98D9-0FC084E922E0}
2013-12-08 09:39 - 2013-12-08 09:39 - 00000000 ____D C:\Users\Magda\AppData\Local\{75E0271E-8C33-4449-9D67-53C0D545898D}
2013-12-07 12:04 - 2013-12-07 12:08 - 00000000 ____D C:\Users\Daniel\AppData\Local\HP
2013-12-07 12:04 - 2013-12-07 12:04 - 00002816 _____ C:\Windows\System32\Tasks\hpUtility.exe_{8A4E6FFE-B9BA-4BEA-8343-F06FCD9BF6FE}
2013-12-07 12:03 - 2013-12-07 12:03 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2013-12-07 12:02 - 2013-12-07 12:02 - 00003636 _____ C:\Windows\System32\Tasks\HPCustParticipation HP Photosmart 5520 series
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\Visan
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-07 12:01 - 2013-12-07 12:01 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\HpUpdate
2013-12-07 12:01 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMB111.dll
2013-12-07 11:59 - 2013-12-07 12:01 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-07 11:59 - 2013-12-07 11:59 - 00000000 ____D C:\ProgramData\HP
2013-12-07 11:57 - 2013-12-07 11:57 - 00000057 _____ C:\ProgramData\Ament.ini
2013-12-07 11:57 - 2013-12-07 11:57 - 00000000 ____D C:\Program Files\HP
2013-12-07 11:52 - 2013-12-07 11:52 - 00000000 ____D C:\Users\Juschus\AppData\Local\HP
2013-12-07 09:45 - 2013-12-07 09:45 - 00000000 ____D C:\Users\Magda\AppData\Local\{F46B2AB1-AB7C-4FC5-A4BC-4477649C9265}
2013-12-06 09:06 - 2013-12-06 09:07 - 00000000 ____D C:\Users\Magda\AppData\Local\{3E0CBBBC-508F-4C1A-859F-5A5017F37FD0}
2013-12-05 19:26 - 2013-12-05 19:26 - 08923288 _____ (Hamrick Software) C:\Users\Juschus\Desktop\vuex6493.exe
2013-12-05 14:27 - 2013-12-05 14:27 - 00000000 ____D C:\Users\Magda\AppData\Local\{A54C94B9-321C-434C-B255-79FA5EED60A1}

==================== One Month Modified Files and Folders =======

2014-01-04 12:56 - 2014-01-04 12:55 - 00024128 _____ C:\Users\Daniel\Desktop\FRST.txt
2014-01-04 12:56 - 2011-12-24 13:16 - 00000000 ____D C:\Users\Daniel\AppData\Local\CrashDumps
2014-01-04 12:55 - 2014-01-04 12:55 - 01931368 _____ (Farbar) C:\Users\Daniel\Desktop\FRST64.exe
2014-01-04 12:47 - 2011-12-23 15:42 - 01606695 _____ C:\Windows\WindowsUpdate.log
2014-01-04 12:46 - 2012-03-21 17:33 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Skype
2014-01-04 12:44 - 2009-07-14 05:51 - 00287854 _____ C:\Windows\setupact.log
2014-01-04 12:32 - 2013-10-28 18:22 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-04 12:09 - 2014-01-04 12:09 - 04182497 _____ C:\Users\Daniel\Downloads\Radikal-Guru-feat_-Rankin-Scroo--My-Trees.zip
2014-01-04 12:00 - 2012-08-23 13:13 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-04 11:36 - 2013-12-04 15:41 - 00004992 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Juschus-VAIO-Daniel Juschus-VAIO
2014-01-04 09:38 - 2014-01-04 09:38 - 00000000 ___RD C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-04 09:38 - 2013-07-30 17:11 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-04 09:38 - 2012-08-23 13:13 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-04 09:32 - 2014-01-04 09:32 - 00000000 ____D C:\Users\Magda\AppData\Local\{779DEC04-3FE6-4871-914C-AD96B270A916}
2014-01-04 09:31 - 2014-01-04 09:31 - 00000000 ___RD C:\Users\Magda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-04 09:22 - 2011-12-28 18:05 - 00000000 ____D C:\Users\Frank\AppData\Local\CrashDumps
2014-01-04 08:56 - 2009-07-14 05:45 - 00020928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-04 08:56 - 2009-07-14 05:45 - 00020928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-04 08:49 - 2014-01-04 08:49 - 00000000 ___RD C:\Users\Frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-04 08:49 - 2011-12-26 17:52 - 00151152 _____ C:\Users\Frank\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-04 08:48 - 2011-08-25 04:52 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-04 08:48 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-03 19:39 - 2014-01-03 19:39 - 00000222 _____ C:\Users\Daniel\Desktop\OMSI 2.url
2014-01-03 18:50 - 2014-01-01 22:16 - 00000000 ____D C:\FRST
2014-01-03 18:49 - 2014-01-03 18:07 - 00000000 ____D C:\AdwCleaner
2014-01-03 18:21 - 2014-01-03 18:21 - 00001034 _____ C:\Users\Juschus\Desktop\JRT.txt
2014-01-03 18:15 - 2014-01-03 18:15 - 00000000 ____D C:\Windows\ERUNT
2014-01-03 17:32 - 2010-11-21 04:47 - 00326598 _____ C:\Windows\PFRO.log
2014-01-02 17:43 - 2011-12-23 15:42 - 00000000 ____D C:\Users\Juschus
2014-01-02 17:41 - 2011-12-23 16:20 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2014-01-02 17:41 - 2011-08-25 04:46 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2014-01-02 17:38 - 2013-04-29 17:11 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\DVDVideoSoft
2014-01-02 17:38 - 2012-06-27 12:14 - 00000000 ____D C:\ProgramData\Freemake
2014-01-02 17:38 - 2012-06-27 12:14 - 00000000 ____D C:\Program Files (x86)\Freemake
2014-01-02 16:36 - 2014-01-02 16:36 - 00051090 _____ C:\ComboFix.txt
2014-01-02 16:36 - 2014-01-02 15:24 - 00000000 ____D C:\Qoobox
2014-01-02 16:36 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-02 16:34 - 2014-01-02 15:24 - 00000000 ____D C:\Windows\erdnt
2014-01-02 16:31 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-02 15:34 - 2013-11-11 19:28 - 00000000 ____D C:\Users\Daniel\Documents\Bluetooth Folder
2014-01-02 15:31 - 2014-01-02 15:31 - 00000000 ___RD C:\Users\Juschus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-01-02 15:21 - 2014-01-02 15:32 - 05160282 ____R (Swearware) C:\Users\Juschus\Desktop\ComboFix.exe
2014-01-02 15:02 - 2011-12-23 15:51 - 00000000 ____D C:\Users\Daniel
2014-01-02 14:51 - 2014-01-02 14:51 - 00000000 ____D C:\Program Files (x86)\7-Zip
2014-01-02 14:14 - 2014-01-02 14:13 - 00290536 _____ C:\Windows\Minidump\010214-25521-01.dmp
2014-01-02 14:13 - 2014-01-02 14:13 - 809872641 _____ C:\Windows\MEMORY.DMP
2014-01-02 14:13 - 2014-01-02 14:13 - 00000000 ____D C:\Windows\Minidump
2014-01-02 10:02 - 2012-02-12 11:12 - 00000000 ____D C:\Users\Magda\AppData\Local\CrashDumps
2014-01-02 09:36 - 2014-01-02 09:36 - 00000000 ____D C:\Users\Magda\AppData\Local\{6FE5E739-57CF-422C-BAAA-42F96BE6380F}
2014-01-02 09:20 - 2011-12-23 18:15 - 00151152 _____ C:\Users\Magda\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-01 22:35 - 2011-12-28 12:19 - 00000000 ____D C:\Users\Juschus\AppData\Local\CrashDumps
2014-01-01 22:15 - 2014-01-01 22:15 - 00000000 _____ C:\Users\Juschus\defogger_reenable
2014-01-01 22:08 - 2014-01-01 22:08 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Malwarebytes
2014-01-01 21:44 - 2009-07-14 06:13 - 00876932 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-01 20:47 - 2014-01-01 20:47 - 04645232 _____ (Piriform Ltd) C:\Users\Juschus\Downloads\ccsetup409.exe
2014-01-01 20:46 - 2014-01-01 20:46 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Malwarebytes
2014-01-01 20:45 - 2014-01-01 20:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Juschus\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-01 20:45 - 2014-01-01 20:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-01 20:43 - 2014-01-01 20:43 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Juschus\Downloads\tdsskiller.exe
2014-01-01 20:25 - 2011-12-23 15:43 - 00000000 ____D C:\Windows\pss
2014-01-01 20:14 - 2011-12-23 15:45 - 00000000 ____D C:\Users\Juschus\Documents\Bluetooth Folder
2014-01-01 18:46 - 2009-07-14 06:08 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-01 14:50 - 2014-01-01 14:50 - 00002475 _____ C:\Users\Public\Desktop\AESHelp for FSX.lnk
2014-01-01 14:43 - 2014-01-01 12:25 - 00000000 ____D C:\Users\Daniel\Downloads\STBuild120713Dev
2014-01-01 14:43 - 2012-01-14 13:15 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\SpinTires
2014-01-01 13:53 - 2014-01-01 13:51 - 33146870 _____ C:\Users\Daniel\Downloads\Ursus tractor and trailers v11.zip
2014-01-01 13:51 - 2014-01-01 13:49 - 20036311 _____ C:\Users\Daniel\Downloads\kamaz master v1.2 .zip
2014-01-01 13:49 - 2014-01-01 13:49 - 07091447 _____ C:\Users\Daniel\Downloads\landcruiserhdj80-v1-2.zip
2014-01-01 13:49 - 2014-01-01 13:48 - 10023942 _____ C:\Users\Daniel\Downloads\actros4141.zip
2014-01-01 13:48 - 2014-01-01 13:48 - 02218739 _____ C:\Users\Daniel\Downloads\SchoolBus.zip
2014-01-01 13:48 - 2014-01-01 13:47 - 10502887 _____ C:\Users\Daniel\Downloads\UAZ_2206.zip
2014-01-01 13:42 - 2014-01-01 13:41 - 05014217 _____ C:\Users\Daniel\Downloads\lancer_evo_v2.zip
2013-12-31 17:12 - 2013-09-29 18:55 - 00000000 ____D C:\Users\Juschus\Documents\Flight Simulator X-Dateien
2013-12-31 12:36 - 2013-12-31 12:36 - 00000000 ____D C:\Users\Daniel\Documents\Visual Studio 2008
2013-12-30 18:43 - 2011-12-23 15:43 - 00151152 _____ C:\Users\Juschus\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-30 18:20 - 2011-12-23 15:52 - 00151152 _____ C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-30 18:17 - 2009-07-14 05:45 - 00638504 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-30 16:26 - 2013-12-30 16:26 - 00002879 _____ C:\Users\Juschus\Desktop\Aviation Jargon Speech Trainer.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00002865 _____ C:\Users\Juschus\Desktop\MCE Aerosoft A320-321.lnk
2013-12-30 16:26 - 2013-12-30 16:26 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Multi Crew Experience
2013-12-30 16:26 - 2013-12-30 16:25 - 00000000 ____D C:\Program Files (x86)\Multi Crew Experience Aerosoft AXA
2013-12-30 16:17 - 2011-08-25 05:48 - 00325427 _____ C:\Windows\DirectX.log
2013-12-30 16:15 - 2013-12-30 16:15 - 00001744 _____ C:\Users\Public\Desktop\RAAS Pro Aerosoft Info.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001664 _____ C:\Users\Public\Desktop\FS2Crew Airbus X Coupon Code.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001539 _____ C:\Users\Public\Desktop\RAAS Pro Manual.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00001524 _____ C:\Users\Public\Desktop\RAAS SDK.lnk
2013-12-30 16:15 - 2013-12-30 16:15 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\RAASPRO
2013-12-30 16:14 - 2013-12-30 16:14 - 00000000 ____D C:\Users\Juschus\Documents\Aerosoft
2013-12-30 15:21 - 2011-12-23 15:52 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\Atheros
2013-12-30 11:39 - 2013-12-30 11:39 - 00000000 ____D C:\Users\Magda\AppData\Local\{5D20C2E2-D23D-424B-B0E5-72B077043D94}
2013-12-29 11:08 - 2013-12-29 11:08 - 00000000 ____D C:\Users\Magda\AppData\Local\{315761DA-B359-4760-A5E0-69B906108EE2}
2013-12-29 10:37 - 2012-04-18 14:14 - 00000000 ____D C:\Users\Daniel\Documents\FFOutput
2013-12-28 12:38 - 2012-09-12 15:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-28 11:34 - 2013-12-28 11:34 - 00000000 ____D C:\Users\Magda\AppData\Local\{90DBF805-FF59-4916-9744-33CACB76D788}
2013-12-28 10:23 - 2013-12-28 10:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-27 18:39 - 2011-12-28 17:47 - 00000000 ____D C:\Users\Magda\AppData\Local\Mozilla
2013-12-27 13:54 - 2013-12-27 13:52 - 77481330 _____ () C:\Users\Daniel\Downloads\vR_BR103_VRot_DE_EN_V1.exe
2013-12-27 11:29 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-27 11:10 - 2013-12-27 11:09 - 00000000 ____D C:\Users\Magda\AppData\Local\{CC6C0AA9-EB09-43FE-BC35-2291B8781A5A}
2013-12-25 09:42 - 2013-12-25 09:42 - 00001292 _____ C:\Users\Magda\Downloads\Koma.acsm
2013-12-25 09:40 - 2013-12-25 09:40 - 00000000 ____D C:\Users\Magda\AppData\Local\{6EEB3E0F-CD1C-4443-B7B5-36C03E55DDC7}
2013-12-23 19:02 - 2013-12-23 19:01 - 00000000 ____D C:\Users\Magda\AppData\Local\{F300B308-5EED-4E18-9A9F-A407904E9B63}
2013-12-23 18:34 - 2013-03-25 13:39 - 00000000 ____D C:\ProgramData\WarThunder
2013-12-23 18:22 - 2013-12-23 18:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-12-23 18:08 - 2013-12-23 18:08 - 00000222 _____ C:\Users\Daniel\Desktop\War Thunder.url
2013-12-23 18:07 - 2013-03-25 11:50 - 00000000 ____D C:\Users\Daniel\AppData\Local\War Thunder
2013-12-23 17:24 - 2013-12-23 17:24 - 00000000 ____D C:\Users\Daniel\Documents\My Games
2013-12-23 13:42 - 2013-12-23 13:42 - 00000221 _____ C:\Users\Daniel\Desktop\Audiosurf.url
2013-12-22 14:37 - 2013-12-22 14:37 - 00000000 ____D C:\Users\Daniel\Documents\Flight Simulator X-Dateien
2013-12-22 10:15 - 2013-12-22 10:15 - 00000000 ____D C:\Users\Magda\AppData\Local\{62FBD19E-EA73-4512-BF0D-3C5D917ADDE6}
2013-12-21 17:43 - 2013-06-19 13:21 - 00000000 ____D C:\Users\Daniel\Documents\Fl Studio Collection
2013-12-21 16:07 - 2013-06-24 16:44 - 00000000 ____D C:\Program Files (x86)\VstPlugins
2013-12-21 12:33 - 2013-12-21 12:33 - 00000000 ____D C:\Users\Daniel\ItchySynths_Overdose_Suite
2013-12-20 15:07 - 2013-12-20 15:06 - 00000000 ____D C:\Users\Magda\AppData\Local\{C5FF207E-7C26-413B-B478-94F3567DE37D}
2013-12-20 12:08 - 2013-12-20 12:08 - 00013653 _____ C:\Users\Daniel\Downloads\file.php
2013-12-19 15:41 - 2013-12-19 15:41 - 00000000 ____D C:\Users\Magda\AppData\Local\{04C22749-51A5-4E01-804A-7E397374B263}
2013-12-19 13:03 - 2013-12-19 13:03 - 00001087 _____ C:\Users\Public\Desktop\OMSI Addon Manager.lnk
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Users\Juschus\AppData\Local\OMSI AM
2013-12-19 13:03 - 2013-12-19 13:03 - 00000000 ____D C:\Program Files (x86)\OMSI Addon Manager
2013-12-19 13:03 - 2011-12-23 15:45 - 00000000 ___RD C:\Users\Juschus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-18 16:26 - 2013-12-18 16:25 - 00000000 ____D C:\Users\Magda\AppData\Local\{B1D7BD16-8A09-4645-A223-C0BB30840CC8}
2013-12-18 10:34 - 2012-01-25 15:47 - 00224335 _____ C:\test.xml
2013-12-18 09:50 - 2013-11-09 12:03 - 00000000 ____D C:\Users\Daniel\Documents\Native Instruments
2013-12-18 09:45 - 2013-12-18 09:45 - 00001059 _____ C:\Users\Public\Desktop\Service Center.lnk
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{C6A355F5-168B-4EEC-AB7C-75594F783EDB}
2013-12-18 09:45 - 2013-12-18 09:45 - 00000000 __HDC C:\ProgramData\{9D18D848-CED5-4665-9D6C-AC997FC4BCDD}
2013-12-18 09:45 - 2013-06-25 15:26 - 00000000 ____D C:\Program Files\Common Files\Native Instruments
2013-12-18 09:45 - 2013-06-25 15:21 - 00000000 ____D C:\Program Files\Native Instruments
2013-12-17 19:21 - 2013-12-17 19:21 - 00000000 ____D C:\Users\Magda\AppData\Local\{B999B746-3469-4828-AAF5-7C2855259D9F}
2013-12-16 18:48 - 2013-08-26 15:45 - 00000000 ____D C:\Users\UpdatusUser\AppData\Local\CrashDumps
2013-12-16 17:17 - 2013-12-16 17:17 - 00000000 ____D C:\Users\Magda\AppData\Local\{1C6A5EDA-C090-40FF-9794-3F1AA8D6A800}
2013-12-16 15:37 - 2012-11-11 15:36 - 00000000 ____D C:\Users\Daniel\Documents\Kindergarten
2013-12-15 19:02 - 2012-04-18 14:04 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 14:03 - 2013-07-29 19:19 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 14:00 - 2012-05-31 17:35 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 10:29 - 2013-12-15 10:29 - 00000000 ____D C:\Users\Magda\AppData\Local\{7C388C7A-3E0D-4142-8648-7D2E6B320611}
2013-12-14 13:15 - 2013-12-14 13:15 - 00000000 ____D C:\Users\Magda\AppData\Local\{B16A09D2-BAFB-4761-8038-1BFABD532C2C}
2013-12-14 13:14 - 2013-12-14 13:13 - 00000000 ____D C:\Users\Daniel\AppData\Roaming\HpUpdate
2013-12-14 11:51 - 2013-12-14 11:51 - 00000000 ____D C:\Users\Magda\AppData\Local\{6AF4FDA7-7A98-47EE-9CEB-8FD47E3C3E9C}
2013-12-13 17:36 - 2013-12-13 17:36 - 00006520 _____ C:\Users\Daniel\.recently-used.xbel
2013-12-13 15:21 - 2013-12-13 15:20 - 00000000 ____D C:\Users\Magda\AppData\Local\{F97DC64B-6D75-4794-88F8-90E2A3174C2F}
2013-12-12 16:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-12 14:37 - 2013-12-12 14:37 - 00000000 ____D C:\Users\Magda\AppData\Local\{73B0FD03-1077-4945-BE13-D7FF872E4AF8}
2013-12-11 17:32 - 2013-10-28 18:22 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 17:32 - 2012-03-30 19:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 17:32 - 2011-08-25 05:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 15:56 - 2013-12-11 15:55 - 00000000 ____D C:\Users\Magda\AppData\Local\{5F228F4F-C961-4A5C-99C5-5AB4C4C3ECDF}
2013-12-11 15:08 - 2013-04-29 20:03 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-12-10 11:05 - 2013-12-10 11:04 - 00000000 ____D C:\Users\Magda\AppData\Local\{A6AD93B5-74D2-4E80-B2AA-B392D250CA0C}
2013-12-09 15:25 - 2013-12-09 15:25 - 00000000 ____D C:\Users\Magda\AppData\Local\{E54230C9-C039-488E-A949-0E0A330CDE43}
2013-12-08 18:59 - 2013-12-08 18:59 - 00000000 ____D C:\Users\Magda\AppData\Local\{C65EFBE5-86F3-419F-98D9-0FC084E922E0}
2013-12-08 09:39 - 2013-12-08 09:39 - 00000000 ____D C:\Users\Magda\AppData\Local\{75E0271E-8C33-4449-9D67-53C0D545898D}
2013-12-07 16:25 - 2012-04-10 13:36 - 00000000 ____D C:\Users\Juschus\AppData\Local\Mozilla
2013-12-07 15:14 - 2013-10-03 18:32 - 00052736 ___SH C:\Users\Daniel\Documents\Thumbs.db
2013-12-07 12:08 - 2013-12-07 12:04 - 00000000 ____D C:\Users\Daniel\AppData\Local\HP
2013-12-07 12:04 - 2013-12-07 12:04 - 00002816 _____ C:\Windows\System32\Tasks\hpUtility.exe_{8A4E6FFE-B9BA-4BEA-8343-F06FCD9BF6FE}
2013-12-07 12:03 - 2013-12-07 12:03 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2013-12-07 12:02 - 2013-12-07 12:02 - 00003636 _____ C:\Windows\System32\Tasks\HPCustParticipation HP Photosmart 5520 series
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\Visan
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-07 12:02 - 2013-12-07 12:02 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-07 12:01 - 2013-12-07 12:01 - 00000000 ____D C:\Users\Juschus\AppData\Roaming\HpUpdate
2013-12-07 12:01 - 2013-12-07 11:59 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-07 11:59 - 2013-12-07 11:59 - 00000000 ____D C:\ProgramData\HP
2013-12-07 11:57 - 2013-12-07 11:57 - 00000057 _____ C:\ProgramData\Ament.ini
2013-12-07 11:57 - 2013-12-07 11:57 - 00000000 ____D C:\Program Files\HP
2013-12-07 11:52 - 2013-12-07 11:52 - 00000000 ____D C:\Users\Juschus\AppData\Local\HP
2013-12-07 09:45 - 2013-12-07 09:45 - 00000000 ____D C:\Users\Magda\AppData\Local\{F46B2AB1-AB7C-4FC5-A4BC-4477649C9265}
2013-12-06 18:55 - 2012-08-23 13:13 - 00003896 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-06 18:55 - 2012-08-23 13:13 - 00003644 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-06 09:07 - 2013-12-06 09:06 - 00000000 ____D C:\Users\Magda\AppData\Local\{3E0CBBBC-508F-4C1A-859F-5A5017F37FD0}
2013-12-05 19:33 - 2011-08-25 04:50 - 00037132 _____ C:\Windows\DPINST.LOG
2013-12-05 19:26 - 2013-12-05 19:26 - 08923288 _____ (Hamrick Software) C:\Users\Juschus\Desktop\vuex6493.exe
2013-12-05 14:27 - 2013-12-05 14:27 - 00000000 ____D C:\Users\Magda\AppData\Local\{A54C94B9-321C-434C-B255-79FA5EED60A1}

Some content of TEMP:
====================
C:\Users\Juschus\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-27 15:02

==================== End Of Log ============================

  ---

  --- --- ---
  
  --- --- ---
  

Addition.txt:

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Wie es aussieht, hat ESET doch noch ne Adware gefunden:

log.txt:

Ist doch nur ein Fund im Q-Verzeichnis

Log von Malwarebytes fehlt. Logs sind immer zu posten, egal ob Fund oder kein Fund, denn es enthält mehr Infos als nur die Funde.

Sorry, den MBAM-log habe ich ganz vergessen.

Hier ist er:

Also soll ich die Adware, die ESET noch gefunden hat einfach ignorieren?

Was hast du "ist nur im Quarantäneordner" nicht verstanden? :wtf:
Oder weiß du nicht was eine Quarantäne ist :confused:

Du hast MB vorher nicht aktualisiert. Bitte den Quickscan mit aktuellen Signaturen wiederholen

Das ist mit jetzt peinlich :pfeiff:

Ja ich weiß, was Quarantäne bedeutet, hab es nur nicht gesehen. Ich hoffe, jetzt stimmt alles:

TFC - Temp File Cleaner

Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

• Öffne die TFC.exe.
  Vista und Win 7 User mit Rechtsklick "als Administrator starten".
• Schließe alle anderen Programme.
• Drücke auf den Button Start.
• Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?