Trojaner-Board - Windows 7 Internet Explorer startet nicht mehr.

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7 Internet Explorer startet nicht mehr. (https://www.trojaner-board.de/152391-windows-7-internet-explorer-startet-mehr.html)

Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken

http://saved.im/mtg0mjy4yjlu/2014-04...ryscantool.png

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-04-2014 02

Ran by Thomas (administrator) on THOMAS on 16-04-2014 23:31:59

Running from C:\Users\Thomas\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE

(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe

(F-Secure Corporation) C:\Program Files (x86)\F-Secure\apps\CCF_Reputation\fsorsp.exe

( ) C:\Windows\system32\lxeecoms.exe

() C:\Megatech\MProtect\MPSERV.EXE

(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe

(Microsoft Corporation) C:\Windows\System32\snmp.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Microsoft Corporation) C:\Windows\sysWow64\SearchProtocolHost.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [lxeemon.exe] => C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe [770728 2011-01-23] ()

HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe [139944 2009-10-01] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9849E5645656CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()

BHO-x32: Lexmark  - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()

Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

Toolbar: HKLM-x32 - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} hxxp://www.dynageo.de/download/dynageoviewer.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()

Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\

FF Extension: Bytemobile Optimization Client - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ []
 

==================== Services (Whitelisted) =================
 

R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)

S3 FSMA; C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Common\FSMA32.EXE [216104 2013-11-26] (F-Secure Corporation)

R2 FSORSPClient; C:\Program Files (x86)\F-Secure\apps\CCF_Reputation\fsorsp.exe [60352 2013-06-25] (F-Secure Corporation)

S2 lxeeCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe [45736 2010-04-14] (Lexmark International, Inc.)

R2 lxee_device; C:\Windows\system32\lxeecoms.exe [1052328 2010-04-14] ( )

R2 lxee_device; C:\Windows\SysWOW64\lxeecoms.exe [598696 2010-04-14] ( )

R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()

R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)

R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)

R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

S2 fshoster; "C:\Program Files (x86)\F-Secure\fshoster32.exe" -hosterid:0 [X]

S3 ServiceLayer; "C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe" [X]

S2 TeamViewer8; "C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2011-12-23] (Bytemobile, Inc.)

S3 F-Secure Gatekeeper; C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [203304 2014-03-04] (F-Secure Corporation)

R1 F-Secure HIPS; C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\HIPS\drivers\fshs.sys [69480 2014-03-04] (F-Secure Corporation)

U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)

R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [56016 2013-08-15] ()

R0 fsbts; C:\Windows\SysWOW64\Drivers\fsbts.sys [42248 2013-06-23] ()

R1 fsvista; C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [13248 2013-06-24] ()

R1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()

R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-04-18] (Secunia)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)

R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2011-12-23] (Bytemobile, Inc.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 fsni; \??\C:\Program Files (x86)\F-Secure\apps\CCF_Scanning\fsni64.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-16 23:21 - 2014-04-16 23:32 - 00009795 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:44 - 2014-04-16 21:45 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 20:37 - 2014-04-16 20:37 - 07195137 _____ () C:\Users\Public\Desktop\fsdiag.zip

2014-04-16 20:27 - 2014-04-16 21:47 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-16 20:27 - 2014-04-16 20:45 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 20:07 - 2014-04-14 20:54 - 00000000 ____D () C:\AdwCleaner

2014-04-14 20:02 - 2014-04-14 20:02 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-14 19:44 - 2012-06-01 07:39 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wamregps.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 07:35 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 07:34 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\admwprox.dll

2014-04-14 19:44 - 2012-06-01 07:33 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\iisreset.exe

2014-04-14 19:44 - 2012-06-01 06:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wamregps.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00154624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admwprox.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 06:34 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisreset.exe

2014-04-13 23:09 - 2014-04-15 06:42 - 00024488 _____ () C:\Windows\iis7.log

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 13:46 - 2014-04-13 14:22 - 00000000 ____D () C:\Qoobox

2014-04-13 13:46 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-13 13:46 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-13 13:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 20:45 - 2014-04-13 16:01 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-12 16:00 - 2014-04-16 23:21 - 00000000 ____D () C:\FRST

2014-04-12 15:57 - 2014-04-16 23:21 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-12 12:03 - 2014-04-16 19:33 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-12 11:25 - 2013-09-12 14:44 - 01544192 _____ () C:\Users\Thomas\Documents\netfx_Full_GDR_x64.msi

2014-04-12 01:26 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-04-12 01:26 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-04-11 23:22 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2014-04-11 23:22 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-04-11 23:22 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2014-04-11 23:22 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2014-04-11 23:22 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2014-04-11 23:22 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-04-11 23:22 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-04-11 23:19 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-04-11 23:19 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 20:17 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-03-19 15:18 - 2014-03-19 15:19 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 21:06 - 2014-03-18 12:08 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt

2014-03-17 20:46 - 2014-03-17 20:46 - 00000000 ____D () C:\Users\Helen\AppData\Local\Adobe
 

==================== One Month Modified Files and Folders =======
 

2014-04-16 23:32 - 2014-04-16 23:21 - 00009795 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-16 23:28 - 2011-01-10 19:40 - 01006030 _____ () C:\ProgramData\lxeescan.log

2014-04-16 23:27 - 2013-07-10 20:42 - 00249786 _____ () C:\Windows\setupact.log

2014-04-16 23:27 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-16 23:26 - 2013-07-10 20:41 - 00315730 _____ () C:\Windows\PFRO.log

2014-04-16 23:26 - 2013-07-10 20:41 - 00017192 _____ () C:\Windows\errord.log

2014-04-16 23:25 - 2009-10-05 17:22 - 01434156 _____ () C:\Windows\WindowsUpdate.log

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 23:21 - 2014-04-12 16:00 - 00000000 ____D () C:\FRST

2014-04-16 23:21 - 2014-04-12 15:57 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-16 22:01 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-16 22:01 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:47 - 2014-04-16 20:27 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:45 - 2014-04-16 21:44 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 21:41 - 2012-09-20 12:14 - 00000000 ____D () C:\Program Files (x86)\F-Secure

2014-04-16 20:48 - 2012-09-20 10:54 - 00000000 ____D () C:\ProgramData\F-Secure

2014-04-16 20:45 - 2014-04-16 20:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-16 20:37 - 2014-04-16 20:37 - 07195137 _____ () C:\Users\Public\Desktop\fsdiag.zip

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 20:18 - 2011-01-10 19:42 - 00000000 ____D () C:\ProgramData\Lx_cats

2014-04-16 20:02 - 2009-07-14 19:58 - 00856596 _____ () C:\Windows\system32\perfh007.dat

2014-04-16 20:02 - 2009-07-14 19:58 - 00210076 _____ () C:\Windows\system32\perfc007.dat

2014-04-16 20:02 - 2009-07-14 07:13 - 02017576 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-04-16 19:34 - 2011-01-10 19:50 - 00211557 _____ () C:\ProgramData\lxee.log

2014-04-16 19:33 - 2014-04-12 12:03 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-16 19:33 - 2011-01-10 19:33 - 00000000 ____D () C:\Program Files\Lexmark Pro700 Series

2014-04-15 06:42 - 2014-04-13 23:09 - 00024488 _____ () C:\Windows\iis7.log

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\inetsrv

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 20:54 - 2014-04-14 20:07 - 00000000 ____D () C:\AdwCleaner

2014-04-14 20:24 - 2012-09-22 20:47 - 00000000 ____D () C:\Users\Thomas\AppData\Local\CrashDumps

2014-04-14 20:02 - 2014-04-14 20:02 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-13 23:10 - 2011-01-10 20:06 - 01903296 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 21:39 - 2010-12-22 23:06 - 00000000 ____D () C:\Program Files\CDBurnerXP

2014-04-13 21:31 - 2009-10-08 17:59 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\vlc

2014-04-13 20:45 - 2013-08-25 18:22 - 00001742 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk

2014-04-13 16:50 - 2013-12-03 09:21 - 00110692 _____ () C:\Windows\IE11_main.log

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 16:27 - 2010-10-03 18:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-13 16:26 - 2013-07-11 18:00 - 286981503 _____ () C:\Windows\MEMORY.DMP

2014-04-13 16:12 - 2011-02-28 14:34 - 00110552 _____ () C:\Users\kuebelstein\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-13 16:01 - 2014-04-12 20:45 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 14:22 - 2014-04-13 13:46 - 00000000 ____D () C:\Qoobox

2014-04-13 14:10 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:42 - 2009-10-08 17:28 - 00000000 ____D () C:\Users\Thomas

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 15:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-12 15:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-12 15:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-04-12 15:04 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Defender

2014-04-12 15:00 - 2009-07-14 20:18 - 00000000 ____D () C:\Program Files\Windows Journal

2014-04-12 14:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-12 14:38 - 2009-07-14 06:45 - 00416024 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-04-12 11:42 - 2013-07-13 12:47 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster

2014-04-11 20:47 - 2013-12-08 14:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-11 19:13 - 2013-12-08 14:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-11 19:13 - 2013-12-08 14:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-11 18:26 - 2013-06-01 15:19 - 00000000 ____D () C:\Users\kuebelstein\AppData\Local\CrashDumps

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 18:18 - 2009-10-05 17:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-11 17:21 - 2009-10-08 17:59 - 00110552 _____ () C:\Users\Thomas\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-11 17:19 - 2013-07-13 12:45 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\WinPatrol

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 21:39 - 2013-07-11 22:55 - 00000000 ____D () C:\Windows\system32\MRT

2014-04-09 21:35 - 2009-10-05 17:56 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-03-24 20:14 - 2009-10-10 10:23 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\TeamViewer

2014-03-24 19:37 - 2014-02-26 10:08 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\FileAdvisor

2014-03-24 19:20 - 2011-05-28 18:13 - 00000797 _____ () C:\ProgramData\lxeeDiagnostics.log

2014-03-24 08:32 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-03-19 15:19 - 2014-03-19 15:18 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 12:08 - 2014-03-18 21:06 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt

2014-03-17 20:46 - 2014-03-17 20:46 - 00000000 ____D () C:\Users\Helen\AppData\Local\Adobe

2014-03-17 20:46 - 2009-10-10 20:14 - 00000000 ____D () C:\Users\Helen\AppData\Roaming\Adobe

2014-03-17 19:40 - 2014-03-16 15:25 - 00000000 ____D () C:\Users\Helen\Documents\CANADA
 

Some content of TEMP:

====================

C:\Users\Thomas\AppData\Local\Temp\avgnt.exe

C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-04-11 19:44
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-04-2014 02

Ran by Thomas at 2014-04-16 23:33:00

Running from C:\Users\Thomas\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Computer Security (Disabled - Up to date) {15414183-282E-D62C-CA37-EF24860A2F17}

AS: Computer Security (Disabled - Up to date) {AE20A067-0E14-D9A2-F087-D456FD8D65AA}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version:  - )

7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\{8F9B1C8E-F50E-4139-8701-45016021E102}) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.18 - Atheros Communications Inc.)

Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)

Browser 7 der Telekom (HKLM-x32\...\Browser 7 der Telekom 27.11 (x86 de)) (Version: 27.11 - Deutsche Telekom AG)

CDBurnerXP (HKLM-x32\...\{5932A5C4-BB44-4CFB-AD66-1B826F4D788B}) (Version: 4.2.4.1423 - Canneverbe Limited)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)

Computer Security 12.77.100.0 (release) (x32 Version: 12.77.100.0 - F-Secure Corporation) Hidden

Defraggler (HKLM\...\Defraggler) (Version: 2.14 - Piriform)

doPDF 6.2  printer (HKLM\...\doPDF 6  printer_is1) (Version:  - Softland)

Driver Genius Professional Edition (HKLM-x32\...\Driver Genius Professional Edition_is1) (Version:  - Driver-Soft Inc.)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Free YouTube Download 3 version 3.0.10.722 (HKLM-x32\...\Free YouTube Download 3_is1) (Version:  - DVDVideoSoft Limited.)

Free YouTube Download version 3.1.40.1031 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.40.1031 - DVDVideoSoft Ltd.)

F-Secure (x32 Version: 1.77.243.0 - F-Secure Corporation) Hidden

F-Secure CCF Reputation (x32 Version: 1.0.25.1877 - F-Secure) Hidden

F-Secure CCF Scanning 1.23.124.8831 (release) (x32 Version: 1.23.124.8831 - F-Secure Corporation) Hidden

F-Secure Network CCF 1.02.128 (x32 Version: 1.02.128 - F-Secure Corporation) Hidden

inSSIDer (HKLM-x32\...\{65A5E87D-7A3F-4819-807D-B86990D5F369}) (Version: 2.1.6 - MetaGeek)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)

Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)

Lexmark  (HKLM-x32\...\{D2C5E510-BE6D-42CC-9F61-E4F939078474}) (Version: 1.0.0.0 - )

Lexmark Pro700 Series (HKLM\...\Lexmark Pro700 Series) (Version:  - Lexmark International, Inc.)

Lexmark Symbolleiste (HKLM-x32\...\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}) (Version: 4.63.37.0 - )

Lexmark Tools for Office (HKLM-x32\...\{10812DE7-2E57-4740-B226-6B3BE34AF9D7}) (Version: 1.29.0.0 - )

Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Small Business 2007 (HKLM-x32\...\SMALLBUSINESSR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden

Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Nokia Connectivity Cable Driver (HKLM-x32\...\{0906982B-A432-4C06-8F01-C01BE1143779}) (Version: 7.1.92.0 - Nokia)

Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.6.36.0 - Nokia)

Nokia Suite (x32 Version: 3.6.36.0 - Nokia) Hidden

Online Safety 2.77.1170.803 (x32 Version: 2.77.1170.803 - F-Secure Corporation) Hidden

Paint.NET v3.5.8 (HKLM\...\{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}) (Version: 3.58.0 - dotPDN LLC)

PC Connectivity Solution (HKLM-x32\...\{BA77F9D2-CD35-41EB-9BC9-769879DFF8A6}) (Version: 12.0.48.0 - Nokia)

PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version:  - )

Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Secunia PSI (3.0.0.7009) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7009 - Secunia)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)

Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)

Vodafone Mobile Broadband (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.1.108.29105 - Vodafone)

Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)

WOT for Internet Explorer (HKLM\...\{DCAEC601-735C-41AE-B84F-D792F09FB7D1}) (Version: 12.8.2.0 - WOT Services Oy)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-04-13 14:05 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {08F1F930-D21C-4D6D-AE49-A6DE05A38D6A} - System32\Tasks\{A631F9C9-B285-4604-B240-ADAA7DF0C9B2} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {52D8B8CC-5360-46EF-8749-9B4019E9FAF8} - System32\Tasks\{C15D03A6-4DC3-4B05-A47A-53AB934C7145} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {575A141B-1066-4A86-AB84-E516A835F297} - System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE} => C:\Program Files (x86)\F-Secure\trigger.exe

Task: {7F842EEF-46EC-4143-9638-D6B2F4201F8C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {8274BF4E-03EC-41AA-873D-9C0F3509DB47} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-11] (Adobe Systems Incorporated)

Task: {A64B5DBE-DCDD-4FF1-BB80-C47383B54B72} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1001 ATTENTION ====> No Task File

Task: {A89B02D8-649B-4DA3-B5A5-C426A5D9852A} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1002 ATTENTION ====> No Task File

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-01-10 19:40 - 2009-11-04 08:17 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxeedrpp.dll

2010-11-07 20:56 - 2007-12-12 11:29 - 00036864 _____ () C:\Megatech\MProtect\MPSERV.EXE

2011-01-10 19:37 - 2011-01-23 19:37 - 00770728 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

2011-01-10 19:37 - 2009-10-01 17:41 - 00139944 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

2013-05-15 16:05 - 2013-05-15 16:05 - 00220096 _____ () C:\Program Files (x86)\F-Secure\daas2.dll

2011-01-10 19:37 - 2010-04-01 12:23 - 00389120 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeescw.dll

2011-01-10 19:37 - 2009-05-27 14:16 - 00192512 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeedatr.dll

2011-01-10 19:37 - 2010-04-01 12:24 - 01159168 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeDRS.dll

2011-01-10 19:37 - 2009-03-10 07:43 - 00155648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeecaps.dll

2011-01-10 19:33 - 2009-02-20 10:48 - 00381440 _____ () C:\Windows\system32\lxeesm.dll

2011-01-10 19:33 - 2009-04-28 09:56 - 00024064 _____ () C:\Windows\system32\lxeesmr.dll

2011-01-10 19:37 - 2009-03-30 14:37 - 00708608 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epwizard.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00159744 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\customui.dll

2011-01-10 19:37 - 2009-03-30 14:35 - 00118784 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Eputil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00139264 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Imagutil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00061440 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epfunct.DLL

2011-01-10 19:37 - 2009-06-23 13:09 - 02203648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPWizRes.dll

2011-01-10 19:37 - 2009-06-23 13:10 - 00045056 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\epstring.dll

2011-01-10 19:37 - 2009-06-23 13:11 - 00102400 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPOEMDll.dll

2011-01-10 19:37 - 2009-04-07 21:25 - 00409600 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\iptk.dll

2011-01-10 19:37 - 2009-03-02 16:25 - 00151552 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeptp.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\startupfolder: C:^Users^Thomas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ctfmon.lnk => C:\Windows\pss\ctfmon.lnk.Startup
 

==================== Faulty Device Manager Devices =============
 

Name: USB2.0 1.3M UVC WebCam

Description: USB-Videogerät

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Microsoft

Service: usbvideo

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/16/2014 11:31:24 PM) (Source: Application Hang) (User: )

Description: Programm FRST64.exe, Version 3.3.10.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: ef0
 

Startzeit: 01cf59bb0330a629
 

Endzeit: 16
 

Anwendungspfad: C:\Users\Thomas\Desktop\FRST64.exe
 

Berichts-ID: 5c41c6f2-c5ae-11e3-a8d6-8ffe2b679e21
 

Error: (04/16/2014 09:51:38 PM) (Source: VmbService) (User: )

Description: GetClient
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:26 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
 

System errors:

=============

Error: (04/16/2014 11:28:38 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Listeneradapter" ist vom Dienst "Net.Tcp-Portfreigabedienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1053
 

Error: (04/16/2014 11:28:25 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "TeamViewer 8" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/16/2014 11:28:22 PM) (Source: SNMP) (User: )

Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
 

Error: (04/16/2014 11:27:38 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Portfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/16/2014 11:27:38 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Net.Tcp-Portfreigabedienst erreicht.
 

Error: (04/16/2014 11:27:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lxeeCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/16/2014 11:27:08 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxeeCATSCustConnectService erreicht.
 

Error: (04/16/2014 11:26:31 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/16/2014 11:26:31 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/16/2014 11:26:31 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 
 

Microsoft Office Sessions:

=========================

Error: (12/08/2012 11:49:25 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 173 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (02/18/2012 00:17:55 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/15/2012 01:00:58 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 192 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/14/2012 11:30:53 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 179 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/25/2011 00:06:30 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/04/2011 02:13:11 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/28/2011 06:08:24 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1800 seconds with 420 seconds of active time.  This session ended with a crash.
 

Error: (07/17/2011 10:50:10 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 39 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (05/29/2011 11:00:23 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (10/02/2010 00:53:07 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-04-13 14:04:39.145

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-04-13 14:04:38.193

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.802

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.246

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.626

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.113

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:26.357

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.888

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.385

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:24.912

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 83%

Total physical RAM: 2013.09 MB

Available physical RAM: 332.52 MB

Total Pagefile: 4026.17 MB

Available Pagefile: 2450.39 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:232.79 GB) (Free:149.68 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 516D077A)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Versuch mal die letzten Reste mit diesem Tool wegzukloppen => ftp://ftp.f-secure.com/support/tools...lationTool.exe

Die Datei in Programme (x86) ist weg. Die in ProgramData ist immer noch drauf.

Frische FRST Logs bitte. Was noch von F-Secure übrig ist können wir dann manuell kicken.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-04-2014 02

Ran by Thomas (administrator) on THOMAS on 17-04-2014 10:45:49

Running from C:\Users\Thomas\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe

( ) C:\Windows\system32\lxeecoms.exe

() C:\Megatech\MProtect\MPSERV.EXE

(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe

(Microsoft Corporation) C:\Windows\System32\snmp.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_13_0_0_182_ActiveX.exe

(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [lxeemon.exe] => C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe [770728 2011-01-23] ()

HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe [139944 2009-10-01] ()

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [180304 2014-04-15] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-25] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9849E5645656CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()

BHO-x32: Lexmark  - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()

Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

Toolbar: HKLM-x32 - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} hxxp://www.dynageo.de/download/dynageoviewer.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()

Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\

FF Extension: Bytemobile Optimization Client - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ []
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [122448 2014-04-15] (Avira Operations GmbH & Co. KG)

R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)

S2 lxeeCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe [45736 2010-04-14] (Lexmark International, Inc.)

R2 lxee_device; C:\Windows\system32\lxeecoms.exe [1052328 2010-04-14] ( )

R2 lxee_device; C:\Windows\SysWOW64\lxeecoms.exe [598696 2010-04-14] ( )

R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()

R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)

R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)

R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

S3 ServiceLayer; "C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe" [X]

S2 TeamViewer8; "C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-25] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2014-02-25] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)

R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2011-12-23] (Bytemobile, Inc.)

U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)

R1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()

R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-04-18] (Secunia)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)

R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2011-12-23] (Bytemobile, Inc.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 fsni; \??\C:\Program Files (x86)\F-Secure\apps\CCF_Scanning\fsni64.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
 

========================== Drivers MD5 =======================
 

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit

C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit

C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit

C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825

C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit

C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49

C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit

C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048

C:\Windows\system32\drivers\appid.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit

C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\athrx.sys A5E770426D18F8EF332A593F3289DA91

C:\Windows\System32\DRIVERS\avgntflt.sys 7806BFCD1D7FA5EC23F7324D4EAFD25B

C:\Windows\System32\DRIVERS\avipbb.sys C3A58DBD18786C338126D30BF8C33D72

C:\Windows\System32\DRIVERS\avkmgr.sys 390184FAD8FCC1B6DA25AEBAE928C3B6

C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit

C:\Windows\System32\drivers\BMLoad.sys 8B1E76B5F86DF4396D77AB09787F6D37

C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B

C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\BthEnum.sys CF98190A94F62E405C8CB255018B2315

C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF

C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4

C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37

C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\cdrom.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit

C:\Windows\System32\CLFS.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit

C:\Windows\System32\Drivers\cng.sys AAFCB52FE0037207FB6FBEA070D25EFE

C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\csc.sys ==> MD5 is legit

C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit

C:\Windows\System32\drivers\discache.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit

C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit

C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D

C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit

C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit

C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit

C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit

C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B

C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0

C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\GEARAspiWDM.sys 8E98D21EE06192492A5671A6144D092F

C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit

C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A

C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit

C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit

C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ew_jubusenum.sys 2342E7FECCA0D4E31BEA5FF6A4E20885

C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit

C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit

C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366

C:\Windows\System32\DRIVERS\igdkmd64.sys C6238C6ABD6AC99F5D152DA4E9439A3D

C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit

C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit

C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit

C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit

C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6

C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit

C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4

C:\Windows\System32\Drivers\ksecpkg.sys 7EFB9333E4ECCE6AE4AE9D777D9E553E

C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\L1E62x64.sys B8E670D7EF61615FA03104552854FAC9

C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit

C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit

C:\Windows\System32\drivers\modem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit

C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit

C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC

C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163

C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C

C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit

C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit

C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit

C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit

C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ATK64AMD.sys 032D35C996F21D19A205A7C8F0B76F3C

C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit

C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88

C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit

C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit

C:\Windows\system32\ckldrv.sys 2263727032E9B19231A706046B8C82D3

C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0

C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit

C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD

C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A

C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit

C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit

C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C

C:\Windows\System32\drivers\pci.sys ==> MD5 is legit

C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit

C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit

C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\psi_mf_amd64.sys DD3FD48D69F5FBBB21D46D1514C1C2DB

C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit

C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34

C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A

C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932

C:\Windows\System32\Drivers\RimUsb_AMD64.sys 7B04C9843921AB1F695FB395422C5360

C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit

C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit

C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit

C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit

C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B

C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28

C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3

C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit

C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit

C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit

C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit

C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE

C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE

C:\Windows\system32\drivers\tcpipBM.sys FBA939B917976B2C37F1B235DFCD4876

C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC

C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8

C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit

C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426

C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit

C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit

C:\Windows\System32\Drivers\usbaapl64.sys FB251567F41BC61988B26731DEC19E4B

C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A

C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31

C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965

C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA

C:\Windows\system32\DRIVERS\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC

C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24

C:\Windows\System32\drivers\usbser.sys 4ACEE387FA8FD39F83564FCD2FC234F2

C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6

C:\Windows\System32\DRIVERS\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3

C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7

C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit

C:\Windows\System32\drivers\vga.sys ==> MD5 is legit

C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit

C:\Windows\System32\drivers\viahduaa.sys 574B29F436C4C63D37020C6E570A7528

C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit

C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit

C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vodafone_K3805-z_dc_enum.sys 1E4D31FEC921300C5F262C52F5FCC666

C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit

C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit

C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4

C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit

C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D

C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit

C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit

C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F

C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

C:\Windows\System32\DRIVERS\ZTEusbmdm6k.sys 8A9E7E6169F92E64D5B5305562E363BB

C:\Windows\System32\DRIVERS\ZTEusbnet.sys 788E574905A3E3A08FC218CADEDCA71F

C:\Windows\System32\DRIVERS\ZTEusbnmea.sys 8A9E7E6169F92E64D5B5305562E363BB

C:\Windows\System32\DRIVERS\ZTEusbser6k.sys 8A9E7E6169F92E64D5B5305562E363BB

C:\Windows\System32\DRIVERS\ZTEusbvoice.sys 8A9E7E6169F92E64D5B5305562E363BB
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-17 08:25 - 2014-04-17 08:27 - 00000000 ____D () C:\AdwCleaner

2014-04-17 08:25 - 2014-04-17 08:25 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-17 07:58 - 2014-04-17 07:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Avira

2014-04-17 07:51 - 2014-02-25 11:41 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-04-17 07:51 - 2014-02-25 11:41 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-04-17 07:51 - 2014-02-25 11:41 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-04-17 07:46 - 2014-04-17 07:51 - 00000000 ____D () C:\ProgramData\Avira

2014-04-17 07:46 - 2014-04-17 07:51 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-04-17 07:46 - 2014-04-17 07:47 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-04-17 07:45 - 2014-04-17 07:45 - 00000000 ____D () C:\ProgramData\Package Cache

2014-04-17 00:45 - 2014-04-17 00:45 - 00001371 _____ () C:\Windows\IE10_main.log

2014-04-17 00:10 - 2014-04-17 00:10 - 00000000 ____D () C:\ProgramData\F-Secure-UninstallationTool

2014-04-16 23:33 - 2014-04-16 23:33 - 00034111 _____ () C:\Users\Thomas\Desktop\Addition.txt

2014-04-16 23:21 - 2014-04-17 10:46 - 00027220 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:44 - 2014-04-16 21:45 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 20:27 - 2014-04-17 00:29 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-16 20:27 - 2014-04-17 00:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 19:44 - 2012-06-01 07:39 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wamregps.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 07:35 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 07:34 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\admwprox.dll

2014-04-14 19:44 - 2012-06-01 07:33 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\iisreset.exe

2014-04-14 19:44 - 2012-06-01 06:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wamregps.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00154624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admwprox.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 06:34 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisreset.exe

2014-04-13 23:09 - 2014-04-15 06:42 - 00024488 _____ () C:\Windows\iis7.log

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 13:46 - 2014-04-13 14:22 - 00000000 ____D () C:\Qoobox

2014-04-13 13:46 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-13 13:46 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-13 13:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 20:45 - 2014-04-13 16:01 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-12 16:00 - 2014-04-17 10:45 - 00000000 ____D () C:\FRST

2014-04-12 15:57 - 2014-04-16 23:21 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-12 12:03 - 2014-04-16 19:33 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-12 11:25 - 2013-09-12 14:44 - 01544192 _____ () C:\Users\Thomas\Documents\netfx_Full_GDR_x64.msi

2014-04-12 01:26 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-04-12 01:26 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-04-11 23:22 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2014-04-11 23:22 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-04-11 23:22 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2014-04-11 23:22 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2014-04-11 23:22 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2014-04-11 23:22 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-04-11 23:22 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-04-11 23:19 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-04-11 23:19 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 20:17 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-03-19 15:18 - 2014-03-19 15:19 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 21:06 - 2014-03-18 12:08 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt
 

==================== One Month Modified Files and Folders =======
 

2014-04-17 10:46 - 2014-04-16 23:21 - 00027220 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-17 10:45 - 2014-04-12 16:00 - 00000000 ____D () C:\FRST

2014-04-17 10:45 - 2013-07-10 20:42 - 00251074 _____ () C:\Windows\setupact.log

2014-04-17 10:31 - 2009-10-05 17:22 - 01549638 _____ () C:\Windows\WindowsUpdate.log

2014-04-17 10:31 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-17 10:31 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-17 10:26 - 2011-01-10 19:40 - 01006580 _____ () C:\ProgramData\lxeescan.log

2014-04-17 10:22 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-17 10:21 - 2013-07-10 20:41 - 00320286 _____ () C:\Windows\PFRO.log

2014-04-17 10:21 - 2013-07-10 20:41 - 00017304 _____ () C:\Windows\errord.log

2014-04-17 08:27 - 2014-04-17 08:25 - 00000000 ____D () C:\AdwCleaner

2014-04-17 08:25 - 2014-04-17 08:25 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-17 08:17 - 2013-12-08 14:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-17 08:17 - 2013-12-08 14:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-17 08:17 - 2009-10-09 22:43 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe

2014-04-17 07:58 - 2014-04-17 07:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Avira

2014-04-17 07:51 - 2014-04-17 07:46 - 00000000 ____D () C:\ProgramData\Avira

2014-04-17 07:51 - 2014-04-17 07:46 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-04-17 07:47 - 2014-04-17 07:46 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-04-17 07:45 - 2014-04-17 07:45 - 00000000 ____D () C:\ProgramData\Package Cache

2014-04-17 00:45 - 2014-04-17 00:45 - 00001371 _____ () C:\Windows\IE10_main.log

2014-04-17 00:29 - 2014-04-16 20:27 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-17 00:29 - 2014-04-16 20:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-17 00:25 - 2012-09-20 10:54 - 00000000 ____D () C:\ProgramData\F-Secure

2014-04-17 00:10 - 2014-04-17 00:10 - 00000000 ____D () C:\ProgramData\F-Secure-UninstallationTool

2014-04-16 23:33 - 2014-04-16 23:33 - 00034111 _____ () C:\Users\Thomas\Desktop\Addition.txt

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 23:21 - 2014-04-12 15:57 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:45 - 2014-04-16 21:44 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 20:18 - 2011-01-10 19:42 - 00000000 ____D () C:\ProgramData\Lx_cats

2014-04-16 20:02 - 2009-07-14 19:58 - 00856596 _____ () C:\Windows\system32\perfh007.dat

2014-04-16 20:02 - 2009-07-14 19:58 - 00210076 _____ () C:\Windows\system32\perfc007.dat

2014-04-16 20:02 - 2009-07-14 07:13 - 02017576 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-04-16 19:34 - 2011-01-10 19:50 - 00211557 _____ () C:\ProgramData\lxee.log

2014-04-16 19:33 - 2014-04-12 12:03 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-16 19:33 - 2011-01-10 19:33 - 00000000 ____D () C:\Program Files\Lexmark Pro700 Series

2014-04-15 06:42 - 2014-04-13 23:09 - 00024488 _____ () C:\Windows\iis7.log

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\inetsrv

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 20:24 - 2012-09-22 20:47 - 00000000 ____D () C:\Users\Thomas\AppData\Local\CrashDumps

2014-04-13 23:10 - 2011-01-10 20:06 - 01903296 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 21:39 - 2010-12-22 23:06 - 00000000 ____D () C:\Program Files\CDBurnerXP

2014-04-13 21:31 - 2009-10-08 17:59 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\vlc

2014-04-13 20:45 - 2013-08-25 18:22 - 00001742 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk

2014-04-13 16:50 - 2013-12-03 09:21 - 00110692 _____ () C:\Windows\IE11_main.log

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 16:27 - 2010-10-03 18:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-13 16:26 - 2013-07-11 18:00 - 286981503 _____ () C:\Windows\MEMORY.DMP

2014-04-13 16:12 - 2011-02-28 14:34 - 00110552 _____ () C:\Users\kuebelstein\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-13 16:01 - 2014-04-12 20:45 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 14:22 - 2014-04-13 13:46 - 00000000 ____D () C:\Qoobox

2014-04-13 14:10 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:42 - 2009-10-08 17:28 - 00000000 ____D () C:\Users\Thomas

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 15:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-12 15:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-12 15:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-04-12 15:04 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Defender

2014-04-12 15:00 - 2009-07-14 20:18 - 00000000 ____D () C:\Program Files\Windows Journal

2014-04-12 14:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-12 14:38 - 2009-07-14 06:45 - 00416024 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-04-12 11:42 - 2013-07-13 12:47 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster

2014-04-11 20:47 - 2013-12-08 14:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-11 18:26 - 2013-06-01 15:19 - 00000000 ____D () C:\Users\kuebelstein\AppData\Local\CrashDumps

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 18:18 - 2009-10-05 17:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-11 17:21 - 2009-10-08 17:59 - 00110552 _____ () C:\Users\Thomas\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-11 17:19 - 2013-07-13 12:45 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\WinPatrol

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 21:39 - 2013-07-11 22:55 - 00000000 ____D () C:\Windows\system32\MRT

2014-04-09 21:35 - 2009-10-05 17:56 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-03-24 20:14 - 2009-10-10 10:23 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\TeamViewer

2014-03-24 19:37 - 2014-02-26 10:08 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\FileAdvisor

2014-03-24 19:20 - 2011-05-28 18:13 - 00000797 _____ () C:\ProgramData\lxeeDiagnostics.log

2014-03-24 08:32 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-03-19 15:19 - 2014-03-19 15:18 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 12:08 - 2014-03-18 21:06 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt
 

Some content of TEMP:

====================

C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== BCD ================================
 

Windows-Start-Manager

---------------------

Bezeichner              {bootmgr}

device                  partition=\Device\HarddiskVolume1

path                    \bootmgr

description             Windows Boot Manager

locale                  de-DE

inherit                 {globalsettings}

default                 {current}

resumeobject            {ad34c7ac-b1ca-11de-a391-8d120aa22b8c}

displayorder            {current}

toolsdisplayorder       {memdiag}

timeout                 30
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {current}

device                  partition=C:

path                    \Windows\system32\winload.exe

description             Windows 7

locale                  de-DE

inherit                 {bootloadersettings}

recoverysequence        {ad34c7ae-b1ca-11de-a391-8d120aa22b8c}

recoveryenabled         Yes

osdevice                partition=C:

systemroot              \Windows

resumeobject            {ad34c7ac-b1ca-11de-a391-8d120aa22b8c}

nx                      OptIn
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {ad34c7ae-b1ca-11de-a391-8d120aa22b8c}

device                  ramdisk=[C:]\Recovery\ad34c7ae-b1ca-11de-a391-8d120aa22b8c\Winre.wim,{ad34c7af-b1ca-11de-a391-8d120aa22b8c}

path                    \windows\system32\winload.exe

description             Windows Recovery Environment

inherit                 {bootloadersettings}

osdevice                ramdisk=[C:]\Recovery\ad34c7ae-b1ca-11de-a391-8d120aa22b8c\Winre.wim,{ad34c7af-b1ca-11de-a391-8d120aa22b8c}

systemroot              \windows

nx                      OptIn

winpe                   Yes
 

Wiederaufnahme aus dem Ruhezustand

----------------------------------

Bezeichner              {ad34c7ac-b1ca-11de-a391-8d120aa22b8c}

device                  partition=C:

path                    \Windows\system32\winresume.exe

description             Windows Resume Application

locale                  de-DE

inherit                 {resumeloadersettings}

filedevice              partition=C:

filepath                \hiberfil.sys

debugoptionenabled      No
 

Windows-Speichertestprogramm

----------------------------

Bezeichner              {memdiag}

device                  partition=\Device\HarddiskVolume1

path                    \boot\memtest.exe

description             Windows-Speicherdiagnose

locale                  de-DE

inherit                 {globalsettings}

badmemoryaccess         Yes
 

EMS-Einstellungen

-----------------

Bezeichner              {emssettings}

bootems                 Yes
 

Debuggereinstellungen

---------------------

Bezeichner              {dbgsettings}

debugtype               Serial

debugport               1

baudrate                115200
 

RAM-Defekte

-----------

Bezeichner              {badmemory}
 

Globale Einstellungen

---------------------

Bezeichner              {globalsettings}

inherit                 {dbgsettings}

                        {emssettings}

                        {badmemory}
 

Startladeprogramm-Einstellungen

-------------------------------

Bezeichner              {bootloadersettings}

inherit                 {globalsettings}

                        {hypervisorsettings}
 

Hypervisoreinstellungen

-------------------

Bezeichner              {hypervisorsettings}

hypervisordebugtype     Serial

hypervisordebugport     1

hypervisorbaudrate      115200
 

Einstellungen zur Ladeprogrammfortsetzung

-----------------------------------------

Bezeichner              {resumeloadersettings}

inherit                 {globalsettings}
 

Ger„teoptionen

--------------

Bezeichner              {ad34c7af-b1ca-11de-a391-8d120aa22b8c}

description             Ramdisk Options

ramdisksdidevice        partition=C:

ramdisksdipath          \Recovery\ad34c7ae-b1ca-11de-a391-8d120aa22b8c\boot.sdi
 
 
 

LastRegBack: 2014-04-11 19:44
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-04-2014 02

Ran by Thomas at 2014-04-17 10:47:16

Running from C:\Users\Thomas\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version:  - )

7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\{8F9B1C8E-F50E-4139-8701-45016021E102}) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.18 - Atheros Communications Inc.)

Avira (HKLM-x32\...\{66116465-9a0c-41ea-ba8e-c572cc3a2eaa}) (Version: 1.0.5218.31571 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.0.5218.31571 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)

Browser 7 der Telekom (HKLM-x32\...\Browser 7 der Telekom 27.11 (x86 de)) (Version: 27.11 - Deutsche Telekom AG)

CDBurnerXP (HKLM-x32\...\{5932A5C4-BB44-4CFB-AD66-1B826F4D788B}) (Version: 4.2.4.1423 - Canneverbe Limited)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)

Computer Security 12.77.100.0 (release) (x32 Version: 12.77.100.0 - F-Secure Corporation) Hidden

Defraggler (HKLM\...\Defraggler) (Version: 2.14 - Piriform)

doPDF 6.2  printer (HKLM\...\doPDF 6  printer_is1) (Version:  - Softland)

Driver Genius Professional Edition (HKLM-x32\...\Driver Genius Professional Edition_is1) (Version:  - Driver-Soft Inc.)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Free YouTube Download 3 version 3.0.10.722 (HKLM-x32\...\Free YouTube Download 3_is1) (Version:  - DVDVideoSoft Limited.)

Free YouTube Download version 3.1.40.1031 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.40.1031 - DVDVideoSoft Ltd.)

F-Secure (x32 Version: 1.77.243.0 - F-Secure Corporation) Hidden

F-Secure CCF Reputation (x32 Version: 1.0.25.1877 - F-Secure) Hidden

F-Secure CCF Scanning 1.23.124.8831 (release) (x32 Version: 1.23.124.8831 - F-Secure Corporation) Hidden

F-Secure Network CCF 1.02.128 (x32 Version: 1.02.128 - F-Secure Corporation) Hidden

inSSIDer (HKLM-x32\...\{65A5E87D-7A3F-4819-807D-B86990D5F369}) (Version: 2.1.6 - MetaGeek)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)

Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)

Lexmark  (HKLM-x32\...\{D2C5E510-BE6D-42CC-9F61-E4F939078474}) (Version: 1.0.0.0 - )

Lexmark Pro700 Series (HKLM\...\Lexmark Pro700 Series) (Version:  - Lexmark International, Inc.)

Lexmark Symbolleiste (HKLM-x32\...\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}) (Version: 4.63.37.0 - )

Lexmark Tools for Office (HKLM-x32\...\{10812DE7-2E57-4740-B226-6B3BE34AF9D7}) (Version: 1.29.0.0 - )

Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Small Business 2007 (HKLM-x32\...\SMALLBUSINESSR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden

Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Nokia Connectivity Cable Driver (HKLM-x32\...\{0906982B-A432-4C06-8F01-C01BE1143779}) (Version: 7.1.92.0 - Nokia)

Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.6.36.0 - Nokia)

Nokia Suite (x32 Version: 3.6.36.0 - Nokia) Hidden

Online Safety 2.77.1170.803 (x32 Version: 2.77.1170.803 - F-Secure Corporation) Hidden

Paint.NET v3.5.8 (HKLM\...\{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}) (Version: 3.58.0 - dotPDN LLC)

PC Connectivity Solution (HKLM-x32\...\{BA77F9D2-CD35-41EB-9BC9-769879DFF8A6}) (Version: 12.0.48.0 - Nokia)

PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version:  - )

Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Secunia PSI (3.0.0.7009) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7009 - Secunia)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)

Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)

Vodafone Mobile Broadband (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.1.108.29105 - Vodafone)

Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)

WOT for Internet Explorer (HKLM\...\{DCAEC601-735C-41AE-B84F-D792F09FB7D1}) (Version: 12.8.2.0 - WOT Services Oy)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-04-13 14:05 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {08F1F930-D21C-4D6D-AE49-A6DE05A38D6A} - System32\Tasks\{A631F9C9-B285-4604-B240-ADAA7DF0C9B2} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {52D8B8CC-5360-46EF-8749-9B4019E9FAF8} - System32\Tasks\{C15D03A6-4DC3-4B05-A47A-53AB934C7145} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {575A141B-1066-4A86-AB84-E516A835F297} - System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE} => C:\Program Files (x86)\F-Secure\trigger.exe

Task: {7F842EEF-46EC-4143-9638-D6B2F4201F8C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {8274BF4E-03EC-41AA-873D-9C0F3509DB47} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-17] (Adobe Systems Incorporated)

Task: {A64B5DBE-DCDD-4FF1-BB80-C47383B54B72} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1001 ATTENTION ====> No Task File

Task: {A89B02D8-649B-4DA3-B5A5-C426A5D9852A} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1002 ATTENTION ====> No Task File

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-01-10 19:40 - 2009-11-04 08:17 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxeedrpp.dll

2010-11-07 20:56 - 2007-12-12 11:29 - 00036864 _____ () C:\Megatech\MProtect\MPSERV.EXE

2011-01-10 19:37 - 2011-01-23 19:37 - 00770728 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

2011-01-10 19:37 - 2009-10-01 17:41 - 00139944 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

2014-04-17 07:51 - 2014-02-25 11:41 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2014-04-15 18:34 - 2014-04-15 18:34 - 00138320 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll

2014-04-15 18:33 - 2014-04-15 18:33 - 00064592 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll

2011-01-10 19:37 - 2010-04-01 12:23 - 00389120 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeescw.dll

2011-01-10 19:37 - 2009-05-27 14:16 - 00192512 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeedatr.dll

2011-01-10 19:37 - 2010-04-01 12:24 - 01159168 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeDRS.dll

2011-01-10 19:37 - 2009-03-10 07:43 - 00155648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeecaps.dll

2011-01-10 19:33 - 2009-02-20 10:48 - 00381440 _____ () C:\Windows\system32\lxeesm.dll

2011-01-10 19:33 - 2009-04-28 09:56 - 00024064 _____ () C:\Windows\system32\lxeesmr.dll

2011-01-10 19:37 - 2009-03-30 14:37 - 00708608 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epwizard.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00159744 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\customui.dll

2011-01-10 19:37 - 2009-03-30 14:35 - 00118784 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Eputil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00139264 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Imagutil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00061440 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epfunct.DLL

2011-01-10 19:37 - 2009-06-23 13:09 - 02203648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPWizRes.dll

2011-01-10 19:37 - 2009-06-23 13:10 - 00045056 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\epstring.dll

2011-01-10 19:37 - 2009-06-23 13:11 - 00102400 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPOEMDll.dll

2011-01-10 19:37 - 2009-04-07 21:25 - 00409600 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\iptk.dll

2011-01-10 19:37 - 2009-03-02 16:25 - 00151552 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeptp.dll

2014-04-16 22:38 - 2014-04-15 18:33 - 00049744 _____ () C:\Users\Thomas\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

2009-02-26 14:46 - 2009-02-26 14:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll

2011-06-22 12:46 - 2011-06-22 12:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll

2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\startupfolder: C:^Users^Thomas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ctfmon.lnk => C:\Windows\pss\ctfmon.lnk.Startup
 

==================== Faulty Device Manager Devices =============
 

Name: USB2.0 1.3M UVC WebCam

Description: USB-Videogerät

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Microsoft

Service: usbvideo

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/17/2014 00:09:09 AM) (Source: .NET Runtime Optimization Service) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x800706be
 

Error: (04/17/2014 00:09:07 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: mscorsvw.exe, Version: 4.0.30319.18408, Zeitstempel: 0x52310992

Name des fehlerhaften Moduls: mscorwks.dll, Version: 2.0.50727.5466, Zeitstempel: 0x503f0115

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00003f94

ID des fehlerhaften Prozesses: 0x%9

Startzeit der fehlerhaften Anwendung: 0xmscorsvw.exe0

Pfad der fehlerhaften Anwendung: mscorsvw.exe1

Pfad des fehlerhaften Moduls: mscorsvw.exe2

Berichtskennung: mscorsvw.exe3
 

Error: (04/17/2014 00:09:06 AM) (Source: .NET Runtime) (User: )

Description: .NET Runtime version 2.0.50727.5466 - Schwerwiegender Fehler im Ausführungsmodul (70F0EF72) (80131506).
 

Error: (04/16/2014 11:31:24 PM) (Source: Application Hang) (User: )

Description: Programm FRST64.exe, Version 3.3.10.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: ef0
 

Startzeit: 01cf59bb0330a629
 

Endzeit: 16
 

Anwendungspfad: C:\Users\Thomas\Desktop\FRST64.exe
 

Berichts-ID: 5c41c6f2-c5ae-11e3-a8d6-8ffe2b679e21
 

Error: (04/16/2014 09:51:38 PM) (Source: VmbService) (User: )

Description: GetClient
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
 

System errors:

=============

Error: (04/17/2014 10:23:57 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Listeneradapter" ist vom Dienst "Net.Tcp-Portfreigabedienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1053
 

Error: (04/17/2014 10:23:33 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "TeamViewer 8" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/17/2014 10:23:33 AM) (Source: SNMP) (User: )

Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
 

Error: (04/17/2014 10:23:09 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Portfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/17/2014 10:23:09 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Net.Tcp-Portfreigabedienst erreicht.
 

Error: (04/17/2014 10:22:20 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lxeeCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/17/2014 10:22:20 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxeeCATSCustConnectService erreicht.
 

Error: (04/17/2014 10:21:34 AM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/17/2014 10:21:34 AM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/17/2014 10:21:34 AM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 
 

Microsoft Office Sessions:

=========================

Error: (12/08/2012 11:49:25 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 173 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (02/18/2012 00:17:55 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/15/2012 01:00:58 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 192 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/14/2012 11:30:53 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 179 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/25/2011 00:06:30 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/04/2011 02:13:11 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/28/2011 06:08:24 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1800 seconds with 420 seconds of active time.  This session ended with a crash.
 

Error: (07/17/2011 10:50:10 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 39 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (05/29/2011 11:00:23 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (10/02/2010 00:53:07 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-04-13 14:04:39.145

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-04-13 14:04:38.193

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.802

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.246

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.626

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.113

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:26.357

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.888

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.385

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:24.912

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 65%

Total physical RAM: 2013.09 MB

Available physical RAM: 702.34 MB

Total Pagefile: 4026.17 MB

Available Pagefile: 2506.76 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:232.79 GB) (Free:149.11 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 516D077A)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Wieso ist denn Avira schon wieder drauf?! Das solltest du doch deinstalliert lassen!

Sorry ! mein Fehler, ist jetzt komplett runter.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-04-2014 02

Ran by Thomas (administrator) on THOMAS on 17-04-2014 14:22:59

Running from C:\Users\Thomas\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe

( ) C:\Windows\system32\lxeecoms.exe

() C:\Megatech\MProtect\MPSERV.EXE

(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe

(Microsoft Corporation) C:\Windows\System32\snmp.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_13_0_0_182_ActiveX.exe

(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [lxeemon.exe] => C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe [770728 2011-01-23] ()

HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe [139944 2009-10-01] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9849E5645656CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()

BHO-x32: Lexmark  - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()

Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

Toolbar: HKLM-x32 - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} hxxp://www.dynageo.de/download/dynageoviewer.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()

Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\

FF Extension: Bytemobile Optimization Client - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ []
 

==================== Services (Whitelisted) =================
 

R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)

S2 lxeeCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe [45736 2010-04-14] (Lexmark International, Inc.)

R2 lxee_device; C:\Windows\system32\lxeecoms.exe [1052328 2010-04-14] ( )

R2 lxee_device; C:\Windows\SysWOW64\lxeecoms.exe [598696 2010-04-14] ( )

R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()

R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)

R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)

R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

S3 ServiceLayer; "C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe" [X]

S2 TeamViewer8; "C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2011-12-23] (Bytemobile, Inc.)

U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)

R1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()

R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-04-18] (Secunia)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2011-12-23] (Bytemobile, Inc.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 fsni; \??\C:\Program Files (x86)\F-Secure\apps\CCF_Scanning\fsni64.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
 

========================== Drivers MD5 =======================
 

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit

C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit

C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit

C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825

C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit

C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit

C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49

C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit

C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048

C:\Windows\system32\drivers\appid.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit

C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\athrx.sys A5E770426D18F8EF332A593F3289DA91

C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit

C:\Windows\System32\drivers\BMLoad.sys 8B1E76B5F86DF4396D77AB09787F6D37

C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B

C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\BthEnum.sys CF98190A94F62E405C8CB255018B2315

C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF

C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4

C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37

C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\cdrom.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit

C:\Windows\System32\CLFS.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit

C:\Windows\System32\Drivers\cng.sys AAFCB52FE0037207FB6FBEA070D25EFE

C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit

C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\csc.sys ==> MD5 is legit

C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit

C:\Windows\System32\drivers\discache.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit

C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit

C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D

C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit

C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit

C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit

C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit

C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit

C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit

C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B

C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0

C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\GEARAspiWDM.sys 8E98D21EE06192492A5671A6144D092F

C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit

C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A

C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit

C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit

C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ew_jubusenum.sys 2342E7FECCA0D4E31BEA5FF6A4E20885

C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit

C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit

C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366

C:\Windows\System32\DRIVERS\igdkmd64.sys C6238C6ABD6AC99F5D152DA4E9439A3D

C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit

C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit

C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit

C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit

C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6

C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit

C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit

C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4

C:\Windows\System32\Drivers\ksecpkg.sys 7EFB9333E4ECCE6AE4AE9D777D9E553E

C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\L1E62x64.sys B8E670D7EF61615FA03104552854FAC9

C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit

C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit

C:\Windows\System32\drivers\modem.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit

C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit

C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit

C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC

C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163

C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C

C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit

C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit

C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit

C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit

C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit

C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ATK64AMD.sys 032D35C996F21D19A205A7C8F0B76F3C

C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit

C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88

C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit

C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit

C:\Windows\system32\ckldrv.sys 2263727032E9B19231A706046B8C82D3

C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit

C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0

C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit

C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD

C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A

C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit

C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit

C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C

C:\Windows\System32\drivers\pci.sys ==> MD5 is legit

C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit

C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit

C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\psi_mf_amd64.sys DD3FD48D69F5FBBB21D46D1514C1C2DB

C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit

C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit

C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34

C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A

C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932

C:\Windows\System32\Drivers\RimUsb_AMD64.sys 7B04C9843921AB1F695FB395422C5360

C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit

C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit

C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit

C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit

C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit

C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B

C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28

C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3

C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit

C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit

C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit

C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit

C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE

C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE

C:\Windows\system32\drivers\tcpipBM.sys FBA939B917976B2C37F1B235DFCD4876

C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC

C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit

C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8

C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit

C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit

C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426

C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit

C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit

C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit

C:\Windows\System32\Drivers\usbaapl64.sys FB251567F41BC61988B26731DEC19E4B

C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A

C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31

C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965

C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA

C:\Windows\system32\DRIVERS\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC

C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24

C:\Windows\System32\drivers\usbser.sys 4ACEE387FA8FD39F83564FCD2FC234F2

C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6

C:\Windows\System32\DRIVERS\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3

C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7

C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit

C:\Windows\System32\drivers\vga.sys ==> MD5 is legit

C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit

C:\Windows\System32\drivers\viahduaa.sys 574B29F436C4C63D37020C6E570A7528

C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit

C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit

C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vodafone_K3805-z_dc_enum.sys 1E4D31FEC921300C5F262C52F5FCC666

C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit

C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit

C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit

C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit

C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4

C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit

C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit

C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D

C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit

C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit

C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F

C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

C:\Windows\System32\DRIVERS\ZTEusbmdm6k.sys 8A9E7E6169F92E64D5B5305562E363BB

C:\Windows\System32\DRIVERS\ZTEusbnet.sys 788E574905A3E3A08FC218CADEDCA71F

C:\Windows\System32\DRIVERS\ZTEusbnmea.sys 8A9E7E6169F92E64D5B5305562E363BB

C:\Windows\System32\DRIVERS\ZTEusbser6k.sys 8A9E7E6169F92E64D5B5305562E363BB

C:\Windows\System32\DRIVERS\ZTEusbvoice.sys 8A9E7E6169F92E64D5B5305562E363BB
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-17 14:22 - 2014-04-17 14:23 - 00025435 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-17 08:25 - 2014-04-17 08:27 - 00000000 ____D () C:\AdwCleaner

2014-04-17 08:25 - 2014-04-17 08:25 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-17 00:45 - 2014-04-17 00:45 - 00001371 _____ () C:\Windows\IE10_main.log

2014-04-17 00:10 - 2014-04-17 00:10 - 00000000 ____D () C:\ProgramData\F-Secure-UninstallationTool

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:44 - 2014-04-16 21:45 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 20:27 - 2014-04-17 00:29 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-16 20:27 - 2014-04-17 00:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 19:44 - 2012-06-01 07:39 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wamregps.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 07:35 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 07:34 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\admwprox.dll

2014-04-14 19:44 - 2012-06-01 07:33 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\iisreset.exe

2014-04-14 19:44 - 2012-06-01 06:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wamregps.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00154624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admwprox.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 06:34 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisreset.exe

2014-04-13 23:09 - 2014-04-15 06:42 - 00024488 _____ () C:\Windows\iis7.log

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 13:46 - 2014-04-13 14:22 - 00000000 ____D () C:\Qoobox

2014-04-13 13:46 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-13 13:46 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-13 13:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 20:45 - 2014-04-13 16:01 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-12 16:00 - 2014-04-17 14:22 - 00000000 ____D () C:\FRST

2014-04-12 15:57 - 2014-04-16 23:21 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-12 12:03 - 2014-04-16 19:33 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-12 11:25 - 2013-09-12 14:44 - 01544192 _____ () C:\Users\Thomas\Documents\netfx_Full_GDR_x64.msi

2014-04-12 01:26 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-04-12 01:26 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-04-11 23:22 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2014-04-11 23:22 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-04-11 23:22 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2014-04-11 23:22 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2014-04-11 23:22 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2014-04-11 23:22 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-04-11 23:22 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-04-11 23:19 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-04-11 23:19 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 20:17 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-03-19 15:18 - 2014-03-19 15:19 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 21:06 - 2014-03-18 12:08 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt
 

==================== One Month Modified Files and Folders =======
 

2014-04-17 14:23 - 2014-04-17 14:22 - 00025435 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-17 14:22 - 2014-04-12 16:00 - 00000000 ____D () C:\FRST

2014-04-17 14:22 - 2013-07-10 20:42 - 00251410 _____ () C:\Windows\setupact.log

2014-04-17 13:20 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-17 13:20 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-17 13:19 - 2009-10-05 17:22 - 01584476 _____ () C:\Windows\WindowsUpdate.log

2014-04-17 13:17 - 2011-01-10 19:40 - 01006690 _____ () C:\ProgramData\lxeescan.log

2014-04-17 13:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-17 13:10 - 2013-07-10 20:41 - 00320624 _____ () C:\Windows\PFRO.log

2014-04-17 13:10 - 2013-07-10 20:41 - 00017332 _____ () C:\Windows\errord.log

2014-04-17 11:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-17 08:27 - 2014-04-17 08:25 - 00000000 ____D () C:\AdwCleaner

2014-04-17 08:25 - 2014-04-17 08:25 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-17 08:17 - 2013-12-08 14:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-17 08:17 - 2013-12-08 14:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-17 08:17 - 2009-10-09 22:43 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe

2014-04-17 00:45 - 2014-04-17 00:45 - 00001371 _____ () C:\Windows\IE10_main.log

2014-04-17 00:29 - 2014-04-16 20:27 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-17 00:29 - 2014-04-16 20:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-17 00:25 - 2012-09-20 10:54 - 00000000 ____D () C:\ProgramData\F-Secure

2014-04-17 00:10 - 2014-04-17 00:10 - 00000000 ____D () C:\ProgramData\F-Secure-UninstallationTool

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 23:21 - 2014-04-12 15:57 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:45 - 2014-04-16 21:44 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 20:18 - 2011-01-10 19:42 - 00000000 ____D () C:\ProgramData\Lx_cats

2014-04-16 20:02 - 2009-07-14 19:58 - 00856596 _____ () C:\Windows\system32\perfh007.dat

2014-04-16 20:02 - 2009-07-14 19:58 - 00210076 _____ () C:\Windows\system32\perfc007.dat

2014-04-16 20:02 - 2009-07-14 07:13 - 02017576 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-04-16 19:34 - 2011-01-10 19:50 - 00211557 _____ () C:\ProgramData\lxee.log

2014-04-16 19:33 - 2014-04-12 12:03 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-16 19:33 - 2011-01-10 19:33 - 00000000 ____D () C:\Program Files\Lexmark Pro700 Series

2014-04-15 06:42 - 2014-04-13 23:09 - 00024488 _____ () C:\Windows\iis7.log

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\inetsrv

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 20:24 - 2012-09-22 20:47 - 00000000 ____D () C:\Users\Thomas\AppData\Local\CrashDumps

2014-04-13 23:10 - 2011-01-10 20:06 - 01903296 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 21:39 - 2010-12-22 23:06 - 00000000 ____D () C:\Program Files\CDBurnerXP

2014-04-13 21:31 - 2009-10-08 17:59 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\vlc

2014-04-13 20:45 - 2013-08-25 18:22 - 00001742 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk

2014-04-13 16:50 - 2013-12-03 09:21 - 00110692 _____ () C:\Windows\IE11_main.log

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 16:27 - 2010-10-03 18:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-13 16:26 - 2013-07-11 18:00 - 286981503 _____ () C:\Windows\MEMORY.DMP

2014-04-13 16:12 - 2011-02-28 14:34 - 00110552 _____ () C:\Users\kuebelstein\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-13 16:01 - 2014-04-12 20:45 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 14:22 - 2014-04-13 13:46 - 00000000 ____D () C:\Qoobox

2014-04-13 14:10 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:42 - 2009-10-08 17:28 - 00000000 ____D () C:\Users\Thomas

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 15:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-12 15:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-04-12 15:04 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Defender

2014-04-12 15:00 - 2009-07-14 20:18 - 00000000 ____D () C:\Program Files\Windows Journal

2014-04-12 14:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-12 14:38 - 2009-07-14 06:45 - 00416024 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-04-12 11:42 - 2013-07-13 12:47 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster

2014-04-11 20:47 - 2013-12-08 14:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-11 18:26 - 2013-06-01 15:19 - 00000000 ____D () C:\Users\kuebelstein\AppData\Local\CrashDumps

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 18:18 - 2009-10-05 17:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-11 17:21 - 2009-10-08 17:59 - 00110552 _____ () C:\Users\Thomas\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-11 17:19 - 2013-07-13 12:45 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\WinPatrol

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 21:39 - 2013-07-11 22:55 - 00000000 ____D () C:\Windows\system32\MRT

2014-04-09 21:35 - 2009-10-05 17:56 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-03-24 20:14 - 2009-10-10 10:23 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\TeamViewer

2014-03-24 19:37 - 2014-02-26 10:08 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\FileAdvisor

2014-03-24 19:20 - 2011-05-28 18:13 - 00000797 _____ () C:\ProgramData\lxeeDiagnostics.log

2014-03-24 08:32 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-03-19 15:19 - 2014-03-19 15:18 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 12:08 - 2014-03-18 21:06 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt
 

Some content of TEMP:

====================

C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== BCD ================================
 

Windows-Start-Manager

---------------------

Bezeichner              {bootmgr}

device                  partition=\Device\HarddiskVolume1

path                    \bootmgr

description             Windows Boot Manager

locale                  de-DE

inherit                 {globalsettings}

default                 {current}

resumeobject            {ad34c7ac-b1ca-11de-a391-8d120aa22b8c}

displayorder            {current}

toolsdisplayorder       {memdiag}

timeout                 30
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {current}

device                  partition=C:

path                    \Windows\system32\winload.exe

description             Windows 7

locale                  de-DE

inherit                 {bootloadersettings}

recoverysequence        {ad34c7ae-b1ca-11de-a391-8d120aa22b8c}

recoveryenabled         Yes

osdevice                partition=C:

systemroot              \Windows

resumeobject            {ad34c7ac-b1ca-11de-a391-8d120aa22b8c}

nx                      OptIn
 

Windows-Startladeprogramm

-------------------------

Bezeichner              {ad34c7ae-b1ca-11de-a391-8d120aa22b8c}

device                  ramdisk=[C:]\Recovery\ad34c7ae-b1ca-11de-a391-8d120aa22b8c\Winre.wim,{ad34c7af-b1ca-11de-a391-8d120aa22b8c}

path                    \windows\system32\winload.exe

description             Windows Recovery Environment

inherit                 {bootloadersettings}

osdevice                ramdisk=[C:]\Recovery\ad34c7ae-b1ca-11de-a391-8d120aa22b8c\Winre.wim,{ad34c7af-b1ca-11de-a391-8d120aa22b8c}

systemroot              \windows

nx                      OptIn

winpe                   Yes
 

Wiederaufnahme aus dem Ruhezustand

----------------------------------

Bezeichner              {ad34c7ac-b1ca-11de-a391-8d120aa22b8c}

device                  partition=C:

path                    \Windows\system32\winresume.exe

description             Windows Resume Application

locale                  de-DE

inherit                 {resumeloadersettings}

filedevice              partition=C:

filepath                \hiberfil.sys

debugoptionenabled      No
 

Windows-Speichertestprogramm

----------------------------

Bezeichner              {memdiag}

device                  partition=\Device\HarddiskVolume1

path                    \boot\memtest.exe

description             Windows-Speicherdiagnose

locale                  de-DE

inherit                 {globalsettings}

badmemoryaccess         Yes
 

EMS-Einstellungen

-----------------

Bezeichner              {emssettings}

bootems                 Yes
 

Debuggereinstellungen

---------------------

Bezeichner              {dbgsettings}

debugtype               Serial

debugport               1

baudrate                115200
 

RAM-Defekte

-----------

Bezeichner              {badmemory}
 

Globale Einstellungen

---------------------

Bezeichner              {globalsettings}

inherit                 {dbgsettings}

                        {emssettings}

                        {badmemory}
 

Startladeprogramm-Einstellungen

-------------------------------

Bezeichner              {bootloadersettings}

inherit                 {globalsettings}

                        {hypervisorsettings}
 

Hypervisoreinstellungen

-------------------

Bezeichner              {hypervisorsettings}

hypervisordebugtype     Serial

hypervisordebugport     1

hypervisorbaudrate      115200
 

Einstellungen zur Ladeprogrammfortsetzung

-----------------------------------------

Bezeichner              {resumeloadersettings}

inherit                 {globalsettings}
 

Ger„teoptionen

--------------

Bezeichner              {ad34c7af-b1ca-11de-a391-8d120aa22b8c}

description             Ramdisk Options

ramdisksdidevice        partition=C:

ramdisksdipath          \Recovery\ad34c7ae-b1ca-11de-a391-8d120aa22b8c\boot.sdi
 
 
 

LastRegBack: 2014-04-11 19:44
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-04-2014 02

Ran by Thomas at 2014-04-17 14:24:05

Running from C:\Users\Thomas\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version:  - )

7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\{8F9B1C8E-F50E-4139-8701-45016021E102}) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.18 - Atheros Communications Inc.)

Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)

Browser 7 der Telekom (HKLM-x32\...\Browser 7 der Telekom 27.11 (x86 de)) (Version: 27.11 - Deutsche Telekom AG)

CDBurnerXP (HKLM-x32\...\{5932A5C4-BB44-4CFB-AD66-1B826F4D788B}) (Version: 4.2.4.1423 - Canneverbe Limited)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)

Computer Security 12.77.100.0 (release) (x32 Version: 12.77.100.0 - F-Secure Corporation) Hidden

Defraggler (HKLM\...\Defraggler) (Version: 2.14 - Piriform)

doPDF 6.2  printer (HKLM\...\doPDF 6  printer_is1) (Version:  - Softland)

Driver Genius Professional Edition (HKLM-x32\...\Driver Genius Professional Edition_is1) (Version:  - Driver-Soft Inc.)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Free YouTube Download 3 version 3.0.10.722 (HKLM-x32\...\Free YouTube Download 3_is1) (Version:  - DVDVideoSoft Limited.)

Free YouTube Download version 3.1.40.1031 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.40.1031 - DVDVideoSoft Ltd.)

F-Secure (x32 Version: 1.77.243.0 - F-Secure Corporation) Hidden

F-Secure CCF Reputation (x32 Version: 1.0.25.1877 - F-Secure) Hidden

F-Secure CCF Scanning 1.23.124.8831 (release) (x32 Version: 1.23.124.8831 - F-Secure Corporation) Hidden

F-Secure Network CCF 1.02.128 (x32 Version: 1.02.128 - F-Secure Corporation) Hidden

inSSIDer (HKLM-x32\...\{65A5E87D-7A3F-4819-807D-B86990D5F369}) (Version: 2.1.6 - MetaGeek)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)

Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)

Lexmark  (HKLM-x32\...\{D2C5E510-BE6D-42CC-9F61-E4F939078474}) (Version: 1.0.0.0 - )

Lexmark Pro700 Series (HKLM\...\Lexmark Pro700 Series) (Version:  - Lexmark International, Inc.)

Lexmark Symbolleiste (HKLM-x32\...\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}) (Version: 4.63.37.0 - )

Lexmark Tools for Office (HKLM-x32\...\{10812DE7-2E57-4740-B226-6B3BE34AF9D7}) (Version: 1.29.0.0 - )

Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Small Business 2007 (HKLM-x32\...\SMALLBUSINESSR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden

Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Nokia Connectivity Cable Driver (HKLM-x32\...\{0906982B-A432-4C06-8F01-C01BE1143779}) (Version: 7.1.92.0 - Nokia)

Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.6.36.0 - Nokia)

Nokia Suite (x32 Version: 3.6.36.0 - Nokia) Hidden

Online Safety 2.77.1170.803 (x32 Version: 2.77.1170.803 - F-Secure Corporation) Hidden

Paint.NET v3.5.8 (HKLM\...\{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}) (Version: 3.58.0 - dotPDN LLC)

PC Connectivity Solution (HKLM-x32\...\{BA77F9D2-CD35-41EB-9BC9-769879DFF8A6}) (Version: 12.0.48.0 - Nokia)

PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version:  - )

Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Secunia PSI (3.0.0.7009) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7009 - Secunia)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)

Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)

Vodafone Mobile Broadband (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.1.108.29105 - Vodafone)

Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)

WOT for Internet Explorer (HKLM\...\{DCAEC601-735C-41AE-B84F-D792F09FB7D1}) (Version: 12.8.2.0 - WOT Services Oy)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-04-13 14:05 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {08F1F930-D21C-4D6D-AE49-A6DE05A38D6A} - System32\Tasks\{A631F9C9-B285-4604-B240-ADAA7DF0C9B2} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {52D8B8CC-5360-46EF-8749-9B4019E9FAF8} - System32\Tasks\{C15D03A6-4DC3-4B05-A47A-53AB934C7145} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {575A141B-1066-4A86-AB84-E516A835F297} - System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE} => C:\Program Files (x86)\F-Secure\trigger.exe

Task: {7F842EEF-46EC-4143-9638-D6B2F4201F8C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {8274BF4E-03EC-41AA-873D-9C0F3509DB47} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-17] (Adobe Systems Incorporated)

Task: {A64B5DBE-DCDD-4FF1-BB80-C47383B54B72} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1001 ATTENTION ====> No Task File

Task: {A89B02D8-649B-4DA3-B5A5-C426A5D9852A} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1002 ATTENTION ====> No Task File

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-01-10 19:40 - 2009-11-04 08:17 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxeedrpp.dll

2010-11-07 20:56 - 2007-12-12 11:29 - 00036864 _____ () C:\Megatech\MProtect\MPSERV.EXE

2011-01-10 19:37 - 2011-01-23 19:37 - 00770728 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

2011-01-10 19:37 - 2009-10-01 17:41 - 00139944 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

2011-01-10 19:37 - 2010-04-01 12:23 - 00389120 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeescw.dll

2011-01-10 19:37 - 2009-05-27 14:16 - 00192512 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeedatr.dll

2011-01-10 19:37 - 2010-04-01 12:24 - 01159168 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeDRS.dll

2011-01-10 19:37 - 2009-03-10 07:43 - 00155648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeecaps.dll

2011-01-10 19:33 - 2009-02-20 10:48 - 00381440 _____ () C:\Windows\system32\lxeesm.dll

2011-01-10 19:33 - 2009-04-28 09:56 - 00024064 _____ () C:\Windows\system32\lxeesmr.dll

2011-01-10 19:37 - 2009-03-30 14:37 - 00708608 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epwizard.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00159744 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\customui.dll

2011-01-10 19:37 - 2009-03-30 14:35 - 00118784 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Eputil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00139264 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Imagutil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00061440 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epfunct.DLL

2011-01-10 19:37 - 2009-06-23 13:09 - 02203648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPWizRes.dll

2011-01-10 19:37 - 2009-06-23 13:10 - 00045056 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\epstring.dll

2011-01-10 19:37 - 2009-06-23 13:11 - 00102400 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPOEMDll.dll

2011-01-10 19:37 - 2009-04-07 21:25 - 00409600 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\iptk.dll

2011-01-10 19:37 - 2009-03-02 16:25 - 00151552 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeptp.dll

2009-02-26 14:46 - 2009-02-26 14:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll

2011-06-22 12:46 - 2011-06-22 12:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll

2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\startupfolder: C:^Users^Thomas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ctfmon.lnk => C:\Windows\pss\ctfmon.lnk.Startup
 

==================== Faulty Device Manager Devices =============
 

Name: USB2.0 1.3M UVC WebCam

Description: USB-Videogerät

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Microsoft

Service: usbvideo

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/17/2014 11:07:07 AM) (Source: .NET Runtime Optimization Service) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x800706be
 

Error: (04/17/2014 11:07:06 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: mscorsvw.exe, Version: 4.0.30319.18408, Zeitstempel: 0x52310992

Name des fehlerhaften Moduls: mscorwks.dll, Version: 2.0.50727.5466, Zeitstempel: 0x503f0115

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00003f94

ID des fehlerhaften Prozesses: 0x%9

Startzeit der fehlerhaften Anwendung: 0xmscorsvw.exe0

Pfad der fehlerhaften Anwendung: mscorsvw.exe1

Pfad des fehlerhaften Moduls: mscorsvw.exe2

Berichtskennung: mscorsvw.exe3
 

Error: (04/17/2014 11:07:05 AM) (Source: .NET Runtime) (User: )

Description: .NET Runtime version 2.0.50727.5466 - Schwerwiegender Fehler im Ausführungsmodul (6D87EF72) (80131506).
 

Error: (04/17/2014 00:09:09 AM) (Source: .NET Runtime Optimization Service) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x800706be
 

Error: (04/17/2014 00:09:07 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: mscorsvw.exe, Version: 4.0.30319.18408, Zeitstempel: 0x52310992

Name des fehlerhaften Moduls: mscorwks.dll, Version: 2.0.50727.5466, Zeitstempel: 0x503f0115

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00003f94

ID des fehlerhaften Prozesses: 0x%9

Startzeit der fehlerhaften Anwendung: 0xmscorsvw.exe0

Pfad der fehlerhaften Anwendung: mscorsvw.exe1

Pfad des fehlerhaften Moduls: mscorsvw.exe2

Berichtskennung: mscorsvw.exe3
 

Error: (04/17/2014 00:09:06 AM) (Source: .NET Runtime) (User: )

Description: .NET Runtime version 2.0.50727.5466 - Schwerwiegender Fehler im Ausführungsmodul (70F0EF72) (80131506).
 

Error: (04/16/2014 11:31:24 PM) (Source: Application Hang) (User: )

Description: Programm FRST64.exe, Version 3.3.10.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: ef0
 

Startzeit: 01cf59bb0330a629
 

Endzeit: 16
 

Anwendungspfad: C:\Users\Thomas\Desktop\FRST64.exe
 

Berichts-ID: 5c41c6f2-c5ae-11e3-a8d6-8ffe2b679e21
 

Error: (04/16/2014 09:51:38 PM) (Source: VmbService) (User: )

Description: GetClient
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
 

System errors:

=============

Error: (04/17/2014 01:12:38 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Listeneradapter" ist vom Dienst "Net.Tcp-Portfreigabedienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1053
 

Error: (04/17/2014 01:12:35 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "TeamViewer 8" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/17/2014 01:12:33 PM) (Source: SNMP) (User: )

Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
 

Error: (04/17/2014 01:12:31 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Portfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/17/2014 01:12:31 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Net.Tcp-Portfreigabedienst erreicht.
 

Error: (04/17/2014 01:11:19 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lxeeCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/17/2014 01:11:19 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxeeCATSCustConnectService erreicht.
 

Error: (04/17/2014 01:10:44 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/17/2014 01:10:44 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/17/2014 01:10:44 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 
 

Microsoft Office Sessions:

=========================

Error: (12/08/2012 11:49:25 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 173 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (02/18/2012 00:17:55 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/15/2012 01:00:58 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 192 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/14/2012 11:30:53 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 179 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/25/2011 00:06:30 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/04/2011 02:13:11 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/28/2011 06:08:24 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1800 seconds with 420 seconds of active time.  This session ended with a crash.
 

Error: (07/17/2011 10:50:10 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 39 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (05/29/2011 11:00:23 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (10/02/2010 00:53:07 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-04-13 14:04:39.145

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-04-13 14:04:38.193

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.802

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.246

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.626

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.113

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:26.357

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.888

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.385

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:24.912

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 59%

Total physical RAM: 2013.09 MB

Available physical RAM: 815.96 MB

Total Pagefile: 4026.17 MB

Available Pagefile: 2743.05 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:232.79 GB) (Free:149.5 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 516D077A)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Warum machst du schon wieder nen Haken bei List BCD rein? Ich versteh es nicht, die anderen Haken sollen doch so gelassen werden wie sie sind bis auf das bei der Addition.txt

Habe ich nicht dran gedacht. Mache nochmal einen FRST Log ohne Haken.

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-04-2014 02

Ran by Thomas (administrator) on THOMAS on 17-04-2014 14:39:30

Running from C:\Users\Thomas\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe

( ) C:\Windows\system32\lxeecoms.exe

() C:\Megatech\MProtect\MPSERV.EXE

(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe

(Microsoft Corporation) C:\Windows\System32\snmp.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

() C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_13_0_0_182_ActiveX.exe

(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [lxeemon.exe] => C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe [770728 2011-01-23] ()

HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe [139944 2009-10-01] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9849E5645656CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()

BHO-x32: Lexmark  - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()

Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

Toolbar: HKLM-x32 - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll ()

Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File

Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()

DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} hxxp://www.dynageo.de/download/dynageoviewer.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()

Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\

FF Extension: Bytemobile Optimization Client - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ []
 

==================== Services (Whitelisted) =================
 

R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)

S2 lxeeCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxeeserv.exe [45736 2010-04-14] (Lexmark International, Inc.)

R2 lxee_device; C:\Windows\system32\lxeecoms.exe [1052328 2010-04-14] ( )

R2 lxee_device; C:\Windows\SysWOW64\lxeecoms.exe [598696 2010-04-14] ( )

R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()

R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)

R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)

R2 SNMP; C:\Windows\SysWOW64\snmp.exe [47616 2010-11-20] (Microsoft Corporation)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

S3 ServiceLayer; "C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe" [X]

S2 TeamViewer8; "C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2011-12-23] (Bytemobile, Inc.)

U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)

R1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()

R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-04-18] (Secunia)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2011-12-23] (Bytemobile, Inc.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 fsni; \??\C:\Program Files (x86)\F-Secure\apps\CCF_Scanning\fsni64.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-17 14:22 - 2014-04-17 14:39 - 00008930 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-17 08:25 - 2014-04-17 08:27 - 00000000 ____D () C:\AdwCleaner

2014-04-17 08:25 - 2014-04-17 08:25 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-17 00:45 - 2014-04-17 00:45 - 00001371 _____ () C:\Windows\IE10_main.log

2014-04-17 00:10 - 2014-04-17 00:10 - 00000000 ____D () C:\ProgramData\F-Secure-UninstallationTool

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:44 - 2014-04-16 21:45 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 20:27 - 2014-04-17 00:29 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-16 20:27 - 2014-04-17 00:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 19:44 - 2012-06-01 07:39 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wamregps.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 07:36 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 07:35 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 07:34 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\admwprox.dll

2014-04-14 19:44 - 2012-06-01 07:33 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\iisreset.exe

2014-04-14 19:44 - 2012-06-01 06:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wamregps.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00154624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisRtl.dll

2014-04-14 19:44 - 2012-06-01 06:37 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisrstap.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admwprox.dll

2014-04-14 19:44 - 2012-06-01 06:35 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ahadmin.dll

2014-04-14 19:44 - 2012-06-01 06:34 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iisreset.exe

2014-04-13 23:09 - 2014-04-15 06:42 - 00024488 _____ () C:\Windows\iis7.log

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 13:46 - 2014-04-13 14:22 - 00000000 ____D () C:\Qoobox

2014-04-13 13:46 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-13 13:46 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-13 13:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-13 13:46 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 20:45 - 2014-04-13 16:01 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-12 16:00 - 2014-04-17 14:39 - 00000000 ____D () C:\FRST

2014-04-12 15:57 - 2014-04-16 23:21 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-12 12:03 - 2014-04-16 19:33 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-12 11:25 - 2013-09-12 14:44 - 01544192 _____ () C:\Users\Thomas\Documents\netfx_Full_GDR_x64.msi

2014-04-12 01:26 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-04-12 01:26 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-04-11 23:22 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2014-04-11 23:22 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-04-11 23:22 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2014-04-11 23:22 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2014-04-11 23:22 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2014-04-11 23:22 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2014-04-11 23:22 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2014-04-11 23:22 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2014-04-11 23:22 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-04-11 23:22 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-04-11 23:22 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-04-11 23:19 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-04-11 23:19 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 20:17 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-03-19 15:18 - 2014-03-19 15:19 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 21:06 - 2014-03-18 12:08 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt
 

==================== One Month Modified Files and Folders =======
 

2014-04-17 14:39 - 2014-04-17 14:22 - 00008930 _____ () C:\Users\Thomas\Desktop\FRST.txt

2014-04-17 14:39 - 2014-04-12 16:00 - 00000000 ____D () C:\FRST

2014-04-17 14:36 - 2013-07-10 20:42 - 00251466 _____ () C:\Windows\setupact.log

2014-04-17 13:20 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-17 13:20 - 2009-07-14 06:45 - 00013568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-17 13:19 - 2009-10-05 17:22 - 01584476 _____ () C:\Windows\WindowsUpdate.log

2014-04-17 13:17 - 2011-01-10 19:40 - 01006690 _____ () C:\ProgramData\lxeescan.log

2014-04-17 13:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-17 13:10 - 2013-07-10 20:41 - 00320624 _____ () C:\Windows\PFRO.log

2014-04-17 13:10 - 2013-07-10 20:41 - 00017332 _____ () C:\Windows\errord.log

2014-04-17 11:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-17 08:27 - 2014-04-17 08:25 - 00000000 ____D () C:\AdwCleaner

2014-04-17 08:25 - 2014-04-17 08:25 - 01426178 _____ () C:\Users\Thomas\Desktop\adwcleaner.exe

2014-04-17 08:17 - 2013-12-08 14:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-17 08:17 - 2013-12-08 14:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-17 08:17 - 2009-10-09 22:43 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe

2014-04-17 00:45 - 2014-04-17 00:45 - 00001371 _____ () C:\Windows\IE10_main.log

2014-04-17 00:29 - 2014-04-16 20:27 - 00001268 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk

2014-04-17 00:29 - 2014-04-16 20:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-17 00:25 - 2012-09-20 10:54 - 00000000 ____D () C:\ProgramData\F-Secure

2014-04-17 00:10 - 2014-04-17 00:10 - 00000000 ____D () C:\ProgramData\F-Secure-UninstallationTool

2014-04-16 23:21 - 2014-04-16 23:21 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion

2014-04-16 23:21 - 2014-04-12 15:57 - 02158592 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe

2014-04-16 21:51 - 2014-04-16 21:51 - 00003282 _____ () C:\Windows\System32\Tasks\{CF5BBEE1-DCD9-4056-A808-88B8FD39FBE5}

2014-04-16 21:45 - 2014-04-16 21:45 - 00003286 _____ () C:\Windows\System32\Tasks\{CE971922-4954-4B46-B212-B8ADE3F25F36}

2014-04-16 21:45 - 2014-04-16 21:44 - 00004522 _____ () C:\Windows\FSUNINST.log

2014-04-16 20:24 - 2014-04-16 20:24 - 00001182 _____ () C:\Users\Thomas\Desktop\revosetup95 - Verknüpfung.lnk

2014-04-16 20:23 - 2014-04-16 20:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe

2014-04-16 20:18 - 2011-01-10 19:42 - 00000000 ____D () C:\ProgramData\Lx_cats

2014-04-16 20:02 - 2009-07-14 19:58 - 00856596 _____ () C:\Windows\system32\perfh007.dat

2014-04-16 20:02 - 2009-07-14 19:58 - 00210076 _____ () C:\Windows\system32\perfc007.dat

2014-04-16 20:02 - 2009-07-14 07:13 - 02017576 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-16 19:37 - 2014-04-16 19:37 - 30267622 _____ () C:\ProgramData\SPL670C.tmp

2014-04-16 19:36 - 2014-04-16 19:36 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-04-16 19:36 - 2014-01-15 15:13 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-04-16 19:34 - 2011-01-10 19:50 - 00211557 _____ () C:\ProgramData\lxee.log

2014-04-16 19:33 - 2014-04-12 12:03 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B3FE02CE-C4CF-4791-9564-2993A284D280}

2014-04-16 19:33 - 2011-01-10 19:33 - 00000000 ____D () C:\Program Files\Lexmark Pro700 Series

2014-04-15 06:42 - 2014-04-13 23:09 - 00024488 _____ () C:\Windows\iis7.log

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\inetsrv

2014-04-15 06:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\inetsrv

2014-04-14 21:16 - 2014-04-14 21:16 - 00000626 _____ () C:\Users\Thomas\Desktop\JRT.txt

2014-04-14 21:05 - 2014-04-14 21:05 - 01016261 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe

2014-04-14 20:24 - 2012-09-22 20:47 - 00000000 ____D () C:\Users\Thomas\AppData\Local\CrashDumps

2014-04-13 23:10 - 2011-01-10 20:06 - 01903296 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\SysWOW64\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\Windows\system32\BestPractices

2014-04-13 23:08 - 2014-04-13 23:08 - 00000000 ____D () C:\inetpub

2014-04-13 21:39 - 2010-12-22 23:06 - 00000000 ____D () C:\Program Files\CDBurnerXP

2014-04-13 21:31 - 2009-10-08 17:59 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\vlc

2014-04-13 20:45 - 2013-08-25 18:22 - 00001742 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk

2014-04-13 16:50 - 2013-12-03 09:21 - 00110692 _____ () C:\Windows\IE11_main.log

2014-04-13 16:27 - 2014-04-13 16:27 - 00278040 _____ () C:\Windows\Minidump\041314-44179-01.dmp

2014-04-13 16:27 - 2010-10-03 18:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-13 16:26 - 2013-07-11 18:00 - 286981503 _____ () C:\Windows\MEMORY.DMP

2014-04-13 16:12 - 2011-02-28 14:34 - 00110552 _____ () C:\Users\kuebelstein\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-13 16:01 - 2014-04-12 20:45 - 00000134 _____ () C:\Users\Thomas\Desktop\Internet Explorer Troubleshooting.url

2014-04-13 14:22 - 2014-04-13 14:22 - 00022705 _____ () C:\ComboFix.txt

2014-04-13 14:22 - 2014-04-13 13:46 - 00000000 ____D () C:\Qoobox

2014-04-13 14:10 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-13 13:44 - 2014-04-13 13:44 - 05194807 ____R (Swearware) C:\Users\Thomas\Desktop\ComboFix.exe

2014-04-12 21:42 - 2009-10-08 17:28 - 00000000 ____D () C:\Users\Thomas

2014-04-12 21:00 - 2014-04-12 21:00 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Mozilla

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Deutsche Telekom AG

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\ProgramData\Telekom-Browser-7

2014-04-12 20:58 - 2014-04-12 20:58 - 00000000 ____D () C:\Program Files (x86)\Deutsche Telekom AG

2014-04-12 15:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-12 15:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-04-12 15:04 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Defender

2014-04-12 15:00 - 2009-07-14 20:18 - 00000000 ____D () C:\Program Files\Windows Journal

2014-04-12 14:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-12 14:38 - 2009-07-14 06:45 - 00416024 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-04-12 11:42 - 2013-07-13 12:47 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster

2014-04-11 20:47 - 2013-12-08 14:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-11 18:26 - 2013-06-01 15:19 - 00000000 ____D () C:\Users\kuebelstein\AppData\Local\CrashDumps

2014-04-11 18:21 - 2014-04-11 18:21 - 00000000 ____D () C:\b2732d948723b94a5b4e43

2014-04-11 18:18 - 2009-10-05 17:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-04-11 17:31 - 2014-04-11 17:31 - 00002950 _____ () C:\Windows\System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE}

2014-04-11 17:21 - 2009-10-08 17:59 - 00110552 _____ () C:\Users\Thomas\AppData\Local\GDIPFONTCACHEV1.DAT

2014-04-11 17:19 - 2013-07-13 12:45 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\WinPatrol

2014-04-10 06:04 - 2014-04-10 06:04 - 00278040 _____ () C:\Windows\Minidump\041014-52416-01.dmp

2014-04-09 21:39 - 2013-07-11 22:55 - 00000000 ____D () C:\Windows\system32\MRT

2014-04-09 21:35 - 2009-10-05 17:56 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-03-24 20:14 - 2009-10-10 10:23 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\TeamViewer

2014-03-24 19:37 - 2014-02-26 10:08 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\FileAdvisor

2014-03-24 19:20 - 2011-05-28 18:13 - 00000797 _____ () C:\ProgramData\lxeeDiagnostics.log

2014-03-24 08:32 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-03-19 15:19 - 2014-03-19 15:18 - 00000000 _____ () C:\ctapi_out_gr.txt

2014-03-18 12:08 - 2014-03-18 21:06 - 12427776 _____ () C:\Users\Helen\Documents\Projektpräsentation Kanada Helen, Nelly, Celine.ppt
 

Some content of TEMP:

====================

C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-04-11 19:44
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-04-2014 02

Ran by Thomas at 2014-04-17 14:40:01

Running from C:\Users\Thomas\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version:  - )

7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\{8F9B1C8E-F50E-4139-8701-45016021E102}) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.18 - Atheros Communications Inc.)

Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)

Browser 7 der Telekom (HKLM-x32\...\Browser 7 der Telekom 27.11 (x86 de)) (Version: 27.11 - Deutsche Telekom AG)

CDBurnerXP (HKLM-x32\...\{5932A5C4-BB44-4CFB-AD66-1B826F4D788B}) (Version: 4.2.4.1423 - Canneverbe Limited)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)

Computer Security 12.77.100.0 (release) (x32 Version: 12.77.100.0 - F-Secure Corporation) Hidden

Defraggler (HKLM\...\Defraggler) (Version: 2.14 - Piriform)

doPDF 6.2  printer (HKLM\...\doPDF 6  printer_is1) (Version:  - Softland)

Driver Genius Professional Edition (HKLM-x32\...\Driver Genius Professional Edition_is1) (Version:  - Driver-Soft Inc.)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Free YouTube Download 3 version 3.0.10.722 (HKLM-x32\...\Free YouTube Download 3_is1) (Version:  - DVDVideoSoft Limited.)

Free YouTube Download version 3.1.40.1031 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.1.40.1031 - DVDVideoSoft Ltd.)

F-Secure (x32 Version: 1.77.243.0 - F-Secure Corporation) Hidden

F-Secure CCF Reputation (x32 Version: 1.0.25.1877 - F-Secure) Hidden

F-Secure CCF Scanning 1.23.124.8831 (release) (x32 Version: 1.23.124.8831 - F-Secure Corporation) Hidden

F-Secure Network CCF 1.02.128 (x32 Version: 1.02.128 - F-Secure Corporation) Hidden

inSSIDer (HKLM-x32\...\{65A5E87D-7A3F-4819-807D-B86990D5F369}) (Version: 2.1.6 - MetaGeek)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)

Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)

Lexmark  (HKLM-x32\...\{D2C5E510-BE6D-42CC-9F61-E4F939078474}) (Version: 1.0.0.0 - )

Lexmark Pro700 Series (HKLM\...\Lexmark Pro700 Series) (Version:  - Lexmark International, Inc.)

Lexmark Symbolleiste (HKLM-x32\...\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}) (Version: 4.63.37.0 - )

Lexmark Tools for Office (HKLM-x32\...\{10812DE7-2E57-4740-B226-6B3BE34AF9D7}) (Version: 1.29.0.0 - )

Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Small Business 2007 (HKLM-x32\...\SMALLBUSINESSR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden

Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Nokia Connectivity Cable Driver (HKLM-x32\...\{0906982B-A432-4C06-8F01-C01BE1143779}) (Version: 7.1.92.0 - Nokia)

Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.6.36.0 - Nokia)

Nokia Suite (x32 Version: 3.6.36.0 - Nokia) Hidden

Online Safety 2.77.1170.803 (x32 Version: 2.77.1170.803 - F-Secure Corporation) Hidden

Paint.NET v3.5.8 (HKLM\...\{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}) (Version: 3.58.0 - dotPDN LLC)

PC Connectivity Solution (HKLM-x32\...\{BA77F9D2-CD35-41EB-9BC9-769879DFF8A6}) (Version: 12.0.48.0 - Nokia)

PhotoFiltre 7 (HKCU\...\PhotoFiltre 7) (Version:  - )

Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Secunia PSI (3.0.0.7009) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7009 - Secunia)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.19045 - TeamViewer)

Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)

Vodafone Mobile Broadband (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.1.108.29105 - Vodafone)

Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)

WOT for Internet Explorer (HKLM\...\{DCAEC601-735C-41AE-B84F-D792F09FB7D1}) (Version: 12.8.2.0 - WOT Services Oy)
 

==================== Restore Points  =========================
 
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-04-13 14:05 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {08F1F930-D21C-4D6D-AE49-A6DE05A38D6A} - System32\Tasks\{A631F9C9-B285-4604-B240-ADAA7DF0C9B2} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {52D8B8CC-5360-46EF-8749-9B4019E9FAF8} - System32\Tasks\{C15D03A6-4DC3-4B05-A47A-53AB934C7145} => C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE [2014-01-29] (Microsoft Corporation)

Task: {575A141B-1066-4A86-AB84-E516A835F297} - System32\Tasks\{C014844F-BF33-4621-8D67-91D89BE72BBE} => C:\Program Files (x86)\F-Secure\trigger.exe

Task: {7F842EEF-46EC-4143-9638-D6B2F4201F8C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {8274BF4E-03EC-41AA-873D-9C0F3509DB47} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-17] (Adobe Systems Incorporated)

Task: {A64B5DBE-DCDD-4FF1-BB80-C47383B54B72} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1001 ATTENTION ====> No Task File

Task: {A89B02D8-649B-4DA3-B5A5-C426A5D9852A} - \WPD\SqmUpload_S-1-5-21-1455869103-1871486101-1430270244-1002 ATTENTION ====> No Task File

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-01-10 19:40 - 2009-11-04 08:17 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxeedrpp.dll

2010-11-07 20:56 - 2007-12-12 11:29 - 00036864 _____ () C:\Megatech\MProtect\MPSERV.EXE

2011-01-10 19:37 - 2011-01-23 19:37 - 00770728 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeemon.exe

2011-01-10 19:37 - 2009-10-01 17:41 - 00139944 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\ezprint.exe

2011-01-10 19:37 - 2010-04-01 12:23 - 00389120 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeescw.dll

2011-01-10 19:37 - 2009-05-27 14:16 - 00192512 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeedatr.dll

2011-01-10 19:37 - 2010-04-01 12:24 - 01159168 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeDRS.dll

2011-01-10 19:37 - 2009-03-10 07:43 - 00155648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeecaps.dll

2011-01-10 19:33 - 2009-02-20 10:48 - 00381440 _____ () C:\Windows\system32\lxeesm.dll

2011-01-10 19:33 - 2009-04-28 09:56 - 00024064 _____ () C:\Windows\system32\lxeesmr.dll

2011-01-10 19:37 - 2009-03-30 14:37 - 00708608 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epwizard.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00159744 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\customui.dll

2011-01-10 19:37 - 2009-03-30 14:35 - 00118784 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Eputil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00139264 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Imagutil.DLL

2011-01-10 19:37 - 2009-03-30 14:35 - 00061440 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\Epfunct.DLL

2011-01-10 19:37 - 2009-06-23 13:09 - 02203648 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPWizRes.dll

2011-01-10 19:37 - 2009-06-23 13:10 - 00045056 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\epstring.dll

2011-01-10 19:37 - 2009-06-23 13:11 - 00102400 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\EPOEMDll.dll

2011-01-10 19:37 - 2009-04-07 21:25 - 00409600 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\iptk.dll

2011-01-10 19:37 - 2009-03-02 16:25 - 00151552 _____ () C:\Program Files (x86)\Lexmark Pro700 Series\lxeeptp.dll

2009-02-26 14:46 - 2009-02-26 14:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll

2011-06-22 12:46 - 2011-06-22 12:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll

2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\startupfolder: C:^Users^Thomas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ctfmon.lnk => C:\Windows\pss\ctfmon.lnk.Startup
 

==================== Faulty Device Manager Devices =============
 

Name: USB2.0 1.3M UVC WebCam

Description: USB-Videogerät

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Microsoft

Service: usbvideo

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/17/2014 11:07:07 AM) (Source: .NET Runtime Optimization Service) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x800706be
 

Error: (04/17/2014 11:07:06 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: mscorsvw.exe, Version: 4.0.30319.18408, Zeitstempel: 0x52310992

Name des fehlerhaften Moduls: mscorwks.dll, Version: 2.0.50727.5466, Zeitstempel: 0x503f0115

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00003f94

ID des fehlerhaften Prozesses: 0x%9

Startzeit der fehlerhaften Anwendung: 0xmscorsvw.exe0

Pfad der fehlerhaften Anwendung: mscorsvw.exe1

Pfad des fehlerhaften Moduls: mscorsvw.exe2

Berichtskennung: mscorsvw.exe3
 

Error: (04/17/2014 11:07:05 AM) (Source: .NET Runtime) (User: )

Description: .NET Runtime version 2.0.50727.5466 - Schwerwiegender Fehler im Ausführungsmodul (6D87EF72) (80131506).
 

Error: (04/17/2014 00:09:09 AM) (Source: .NET Runtime Optimization Service) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.IdentityModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x800706be
 

Error: (04/17/2014 00:09:07 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: mscorsvw.exe, Version: 4.0.30319.18408, Zeitstempel: 0x52310992

Name des fehlerhaften Moduls: mscorwks.dll, Version: 2.0.50727.5466, Zeitstempel: 0x503f0115

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00003f94

ID des fehlerhaften Prozesses: 0x%9

Startzeit der fehlerhaften Anwendung: 0xmscorsvw.exe0

Pfad der fehlerhaften Anwendung: mscorsvw.exe1

Pfad des fehlerhaften Moduls: mscorsvw.exe2

Berichtskennung: mscorsvw.exe3
 

Error: (04/17/2014 00:09:06 AM) (Source: .NET Runtime) (User: )

Description: .NET Runtime version 2.0.50727.5466 - Schwerwiegender Fehler im Ausführungsmodul (70F0EF72) (80131506).
 

Error: (04/16/2014 11:31:24 PM) (Source: Application Hang) (User: )

Description: Programm FRST64.exe, Version 3.3.10.2 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: ef0
 

Startzeit: 01cf59bb0330a629
 

Endzeit: 16
 

Anwendungspfad: C:\Users\Thomas\Desktop\FRST64.exe
 

Berichts-ID: 5c41c6f2-c5ae-11e3-a8d6-8ffe2b679e21
 

Error: (04/16/2014 09:51:38 PM) (Source: VmbService) (User: )

Description: GetClient
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 

Error: (04/16/2014 09:41:27 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"1".

Die abhängige Assemblierung "F-Secure.Qt_4_6_2,processorArchitecture="x86",publicKeyToken="2e112a926211c0a3",type="win32",version="4.6.482.77"" konnte nicht gefunden werden.

Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
 

System errors:

=============

Error: (04/17/2014 01:12:38 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Listeneradapter" ist vom Dienst "Net.Tcp-Portfreigabedienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1053
 

Error: (04/17/2014 01:12:35 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "TeamViewer 8" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/17/2014 01:12:33 PM) (Source: SNMP) (User: )

Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
 

Error: (04/17/2014 01:12:31 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp-Portfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/17/2014 01:12:31 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Net.Tcp-Portfreigabedienst erreicht.
 

Error: (04/17/2014 01:11:19 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lxeeCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (04/17/2014 01:11:19 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxeeCATSCustConnectService erreicht.
 

Error: (04/17/2014 01:10:44 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/17/2014 01:10:44 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 

Error: (04/17/2014 01:10:44 PM) (Source: atapi) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
 
 

Microsoft Office Sessions:

=========================

Error: (12/08/2012 11:49:25 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 173 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (02/18/2012 00:17:55 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/15/2012 01:00:58 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 192 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (01/14/2012 11:30:53 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 179 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/25/2011 00:06:30 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/04/2011 02:13:11 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/28/2011 06:08:24 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 1800 seconds with 420 seconds of active time.  This session ended with a crash.
 

Error: (07/17/2011 10:50:10 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6557.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 39 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (05/29/2011 11:00:23 AM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (10/02/2010 00:53:07 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-04-13 14:04:39.145

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-04-13 14:04:38.193

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.802

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:40.246

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.626

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-23 11:05:39.113

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:26.357

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.888

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:25.385

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2013-06-22 17:11:24.912

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 61%

Total physical RAM: 2013.09 MB

Available physical RAM: 771.98 MB

Total Pagefile: 4026.17 MB

Available Pagefile: 2714.6 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:232.79 GB) (Free:149.5 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 516D077A)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Okay, dann bitte Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=fd9a806cc43e054f9bf38a7abbfd8bdb

# engine=17928

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-04-17 05:14:32

# local_time=2014-04-17 07:14:32 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776574 100 94 447028 149384722 0 0

# scanned=221639

# found=0

# cleaned=0

# scan_time=8906

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 
 

Protection, 17.04.2014 15:48:33, SYSTEM, THOMAS, Protection, Malware Protection, Starting, 

Protection, 17.04.2014 15:48:33, SYSTEM, THOMAS, Protection, Malware Protection, Started, 

Protection, 17.04.2014 15:48:33, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 15:48:34, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Update, 17.04.2014 15:48:41, SYSTEM, THOMAS, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1, 

Update, 17.04.2014 15:48:53, SYSTEM, THOMAS, Manual, Malware Database, 2014.3.4.9, 2014.4.17.3, 

Protection, 17.04.2014 15:48:55, SYSTEM, THOMAS, Protection, Refresh, Starting, 

Protection, 17.04.2014 15:48:55, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 15:48:55, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 15:49:00, SYSTEM, THOMAS, Protection, Refresh, Success, 

Protection, 17.04.2014 15:49:00, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 15:49:01, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Protection, 17.04.2014 15:50:16, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 15:50:17, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 15:50:17, SYSTEM, THOMAS, Protection, Malware Protection, Stopping, 

Protection, 17.04.2014 15:50:17, SYSTEM, THOMAS, Protection, Malware Protection, Stopped, 

Protection, 17.04.2014 15:50:35, SYSTEM, THOMAS, Protection, Malware Protection, Starting, 

Protection, 17.04.2014 15:50:35, SYSTEM, THOMAS, Protection, Malware Protection, Started, 

Protection, 17.04.2014 15:50:35, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 15:50:36, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Update, 17.04.2014 15:50:38, SYSTEM, THOMAS, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1, 

Update, 17.04.2014 15:50:51, SYSTEM, THOMAS, Manual, Malware Database, 2014.3.4.9, 2014.4.17.4, 

Protection, 17.04.2014 15:50:52, SYSTEM, THOMAS, Protection, Refresh, Starting, 

Protection, 17.04.2014 15:50:52, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 15:50:52, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 15:50:58, SYSTEM, THOMAS, Protection, Refresh, Success, 

Protection, 17.04.2014 15:50:58, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 15:50:59, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Protection, 17.04.2014 16:32:33, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 16:32:34, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 16:32:34, SYSTEM, THOMAS, Protection, Malware Protection, Stopping, 

Protection, 17.04.2014 16:32:52, SYSTEM, THOMAS, Protection, Malware Protection, Stopped, 

Protection, 17.04.2014 16:33:12, SYSTEM, THOMAS, Protection, Malware Protection, Starting, 

Protection, 17.04.2014 16:33:12, SYSTEM, THOMAS, Protection, Malware Protection, Started, 

Protection, 17.04.2014 16:33:12, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 16:33:15, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Update, 17.04.2014 16:33:17, SYSTEM, THOMAS, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1, 

Update, 17.04.2014 16:33:29, SYSTEM, THOMAS, Manual, Malware Database, 2014.3.4.9, 2014.4.17.4, 

Protection, 17.04.2014 16:33:31, SYSTEM, THOMAS, Protection, Refresh, Starting, 

Protection, 17.04.2014 16:33:31, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 16:33:31, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 16:33:37, SYSTEM, THOMAS, Protection, Refresh, Success, 

Protection, 17.04.2014 16:33:37, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 16:33:37, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Protection, 17.04.2014 16:35:40, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 16:35:41, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 16:35:41, SYSTEM, THOMAS, Protection, Malware Protection, Stopping, 

Protection, 17.04.2014 16:35:41, SYSTEM, THOMAS, Protection, Malware Protection, Stopped, 

Protection, 17.04.2014 16:35:56, SYSTEM, THOMAS, Protection, Malware Protection, Starting, 

Protection, 17.04.2014 16:35:56, SYSTEM, THOMAS, Protection, Malware Protection, Started, 

Protection, 17.04.2014 16:35:56, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 16:35:57, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Update, 17.04.2014 16:35:59, SYSTEM, THOMAS, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1, 

Update, 17.04.2014 16:36:11, SYSTEM, THOMAS, Manual, Malware Database, 2014.3.4.9, 2014.4.17.4, 

Protection, 17.04.2014 16:36:13, SYSTEM, THOMAS, Protection, Refresh, Starting, 

Protection, 17.04.2014 16:36:13, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 16:36:13, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 16:36:19, SYSTEM, THOMAS, Protection, Refresh, Success, 

Protection, 17.04.2014 16:36:19, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 16:36:19, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Protection, 17.04.2014 16:37:37, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 16:37:37, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 16:37:37, SYSTEM, THOMAS, Protection, Malware Protection, Stopping, 

Protection, 17.04.2014 16:37:38, SYSTEM, THOMAS, Protection, Malware Protection, Stopped, 

Protection, 17.04.2014 16:37:53, SYSTEM, THOMAS, Protection, Malware Protection, Starting, 

Protection, 17.04.2014 16:37:53, SYSTEM, THOMAS, Protection, Malware Protection, Started, 

Protection, 17.04.2014 16:37:53, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 16:37:55, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 

Update, 17.04.2014 16:37:57, SYSTEM, THOMAS, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1, 

Update, 17.04.2014 16:38:08, SYSTEM, THOMAS, Manual, Malware Database, 2014.3.4.9, 2014.4.17.4, 

Protection, 17.04.2014 16:38:10, SYSTEM, THOMAS, Protection, Refresh, Starting, 

Protection, 17.04.2014 16:38:10, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopping, 

Protection, 17.04.2014 16:38:10, SYSTEM, THOMAS, Protection, Malicious Website Protection, Stopped, 

Protection, 17.04.2014 16:38:16, SYSTEM, THOMAS, Protection, Refresh, Success, 

Protection, 17.04.2014 16:38:16, SYSTEM, THOMAS, Protection, Malicious Website Protection, Starting, 

Protection, 17.04.2014 16:38:16, SYSTEM, THOMAS, Protection, Malicious Website Protection, Started, 
 

(end)

Falsches Log von MBAM. Poste das Suchlauf Protokoll vom manuellen Scan, keine Protection Logs.