Windows 8: Mehrere Trojaner - ständig Popups im IE
Hallo Freunde,
ich habe leider ein Problem bei einem unserer Rechner. Es tauchen immer wieder Popups im Internet Explorer auf. Zusätzlich sind nach jedem Neustart irgendwelche Programme installiert (Bsp.: Allin1Convert). Ich habe aus Verzweiflung schon Spybot S&D, HitmanPro, Adwcleaner durchlaufen lassen. Diese finden immer wieder was. löschen die Sachen, aber nach einem Neustart ist wieder alles da. Norton 360 ist installiert, bringt aber anscheinend nichts.
Deswegen wende ich mich jetzt an euch.
ADWCleaner: Code:
# AdwCleaner v3.213 - Bericht erstellt am 23/06/2014 um 18:14:34
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzername : Günter Krüger - BÜRO1
# Gestartet von : C:\Users\Günter Krüger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L4G7UOG5\adwcleaner_3.213.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\Allin1Convert_8h
Ordner Gelöscht : C:\Users\GNTERK~1\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Günter Krüger\AppData\LocalLow\Allin1Convert_8hEI
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Allin1Convert_8h.ToolbarProtector.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{889F49D2-6CEA-40BE-BE5F-7217485F9745}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2561FD25-FE31-4E56-A120-AF7FEAAE3124}
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16921
*************************
AdwCleaner[R0].txt - [23888 octets] - [16/06/2014 14:13:16]
AdwCleaner[R1].txt - [1068 octets] - [16/06/2014 14:56:14]
AdwCleaner[R2].txt - [1245 octets] - [16/06/2014 18:15:19]
AdwCleaner[R3].txt - [1026 octets] - [22/06/2014 13:08:00]
AdwCleaner[R4].txt - [1777 octets] - [23/06/2014 18:14:09]
AdwCleaner[S0].txt - [21717 octets] - [16/06/2014 14:13:53]
AdwCleaner[S1].txt - [1084 octets] - [16/06/2014 14:56:44]
AdwCleaner[S2].txt - [1261 octets] - [16/06/2014 18:15:37]
AdwCleaner[S3].txt - [1652 octets] - [23/06/2014 18:14:34]
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1712 octets] ##########
Defogger: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:39 on 23/06/2014 (Günter Krüger)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Code:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Günter Krüger (administrator) on BÜRO1 on 23-06-2014 18:42:09
Running from C:\Users\Günter Krüger\Downloads
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\n360.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\HPNetworkCommunicatorCom.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
() C:\Users\Günter Krüger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3PQGC9T\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2014-02-21] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2014-02-21] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] ()
HKLM-x32\...\Run: [DT HPO] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [120400 2012-08-16] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-02] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [HP Officejet Pro X476dw MFP (NET)] => C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [EasySpeedCheck] => C:\Program Files (x86)\Easy Speed Check\easyspeedcheck.exe [194200 2014-05-12] (Probit Software LTD)
HKU\S-1-5-21-4255365308-323029514-2548571210-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VR-NetWorld Auftragsprüfung.lnk
ShortcutTarget: VR-NetWorld Auftragsprüfung.lnk -> C:\Program Files (x86)\VR-NetWorld\VRToolCheckOrder.exe (VR-NetWorld Software)
ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://1und1.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK13/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM - {E8A2C5C5-5C68-491F-AA49-CA86A08329C5} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - {E8A2C5C5-5C68-491F-AA49-CA86A08329C5} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-02-13]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-06-23]
FF HKCU\...\Firefox\Extensions: [{C9BD4C68-D86F-71D3-5841-B16F1DEC93F6}] - C:\Program Files (x86)\BlockAndSurf-soft\173.xpi
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\Program Files\IDT\WDM\AESTSr64.exe [89600 2014-02-21] (Andrea Electronics Corporation) [File not signed]
R2 AVerRemote; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [364544 2014-02-21] (AVerMedia) [File not signed]
R2 AVerScheduleService; c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [772096 2014-02-21] () [File not signed]
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2228440 2014-02-21] (Broadcom Corporation.)
R2 cjpcsc; C:\windows\SysWOW64\cjpcsc.exe [518192 2014-01-27] (REINER SCT)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
S2 CLKMSVC10_38F51D56; c:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-07-16] (CyberLink)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-16] (Portrait Displays, Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [85504 2012-08-15] (Hewlett-Packard Company) [File not signed]
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-08-29] (Hewlett-Packard)
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129336 2014-02-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2014-02-21] (Intel Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\N360.exe [265040 2014-05-11] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [327680 2014-02-21] (IDT, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 AVerIT13x; C:\Windows\System32\Drivers\AVerIT13x_x64.sys [197504 2014-02-21] (AVerMedia TECHNOLOGIES, Inc.)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170200 2014-02-21] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [9525936 2013-06-10] (Broadcom Corporation)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [1530160 2014-05-10] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 BTWPANFL; C:\windows\system32\drivers\btwpanfl.sys [44912 2014-02-21] (Broadcom Corporation.)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R3 cjusb; C:\Windows\system32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
R3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-06-23] ()
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140620.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140623.001\ENG64.SYS [126040 2014-02-12] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140623.001\EX64.SYS [2099288 2014-02-12] (Symantec Corporation)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1503000.00C\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1503000.00C\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1503000.00C\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-02-13] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-23 18:42 - 2014-06-23 18:42 - 00021276 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-23 18:42 - 2014-06-23 18:42 - 00000000 ____D () C:\FRST
2014-06-23 18:40 - 2014-06-23 18:41 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:08 - 2014-06-23 18:12 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 18:01 - 2014-06-23 06:59 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 18:01 - 2014-06-23 06:59 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:33 - 2014-06-22 17:41 - 00000000 ____D () C:\Qoobox
2014-06-22 17:33 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-22 17:33 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-22 17:33 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-22 17:33 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-22 17:32 - 2014-06-22 17:39 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:30 - 2014-06-22 17:31 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 13:47 - 2014-06-23 18:01 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-22 13:46 - 2014-06-22 13:47 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-22 13:46 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-22 13:46 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-22 13:46 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-22 13:38 - 2014-06-22 13:38 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-22 13:38 - 2014-06-22 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-22 13:18 - 2014-06-22 13:18 - 00001393 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00001381 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 13:17 - 2014-06-22 13:53 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 13:17 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-22 13:17 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 14:13 - 2014-06-23 18:14 - 00000000 ____D () C:\AdwCleaner
2014-06-16 14:12 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\SysWOW64\dhRichClient3.dll
2014-06-16 14:12 - 2011-03-25 20:42 - 00338432 _____ () C:\windows\SysWOW64\sqlite36_engine.dll
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-15 13:25 - 2014-06-22 13:35 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-13 12:47 - 2014-06-22 13:37 - 00000000 ____D () C:\Program Files (x86)\Easy Speed Check
2014-06-13 12:47 - 2014-06-13 12:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-13 12:46 - 2014-06-22 13:35 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-13 12:29 - 2014-06-16 13:54 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-13 12:26 - 2014-06-22 14:03 - 00000000 ____D () C:\temp
2014-06-12 13:10 - 2014-05-24 04:48 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:10 - 2014-05-24 04:47 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 01366016 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-06-12 13:10 - 2014-05-24 04:47 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 19290112 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 15368704 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 02650112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 04:46 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 04:45 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 04:45 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 14365696 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-06-12 13:10 - 2014-05-24 03:26 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 13731328 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02862080 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-06-12 13:10 - 2014-05-24 03:25 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-06-12 13:10 - 2014-05-24 03:25 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-06-12 13:10 - 2014-05-24 03:09 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 03:03 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-06-12 13:10 - 2014-05-24 00:37 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-06-12 13:10 - 2014-05-03 07:47 - 03246592 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-06-12 13:10 - 2014-05-03 05:34 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2014-06-12 13:10 - 2014-04-30 00:32 - 01301504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-06-12 13:10 - 2014-04-30 00:22 - 01023488 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-06-12 13:10 - 2014-04-03 13:19 - 00328024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2014-06-12 13:10 - 2014-04-03 05:44 - 00619008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2014-06-12 13:10 - 2014-04-01 00:08 - 00387268 _____ () C:\windows\system32\ApnDatabase.xml
2014-06-12 13:10 - 2014-03-25 01:42 - 00305152 _____ (Microsoft Corporation) C:\windows\SysWOW64\wusa.exe
2014-06-12 13:10 - 2014-03-25 00:56 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\wusa.exe
2014-06-12 13:09 - 2014-04-03 13:22 - 02233176 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:09 - 2014-03-07 02:47 - 01419264 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2014-06-12 13:09 - 2014-03-07 02:08 - 01845760 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
==================== One Month Modified Files and Folders =======
2014-06-23 18:42 - 2014-06-23 18:42 - 00021276 _____ () C:\Users\Günter Krüger\Downloads\FRST.txt
2014-06-23 18:42 - 2014-06-23 18:42 - 00000000 ____D () C:\FRST
2014-06-23 18:41 - 2014-06-23 18:40 - 02082816 _____ (Farbar) C:\Users\Günter Krüger\Downloads\FRST64.exe
2014-06-23 18:39 - 2014-06-23 18:39 - 00000488 _____ () C:\Users\Günter Krüger\Desktop\defogger_disable.log
2014-06-23 18:39 - 2014-06-23 18:39 - 00000000 _____ () C:\Users\Günter Krüger\defogger_reenable
2014-06-23 18:39 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger
2014-06-23 18:27 - 2014-03-26 16:39 - 00005156 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Büro1-Günter Krüger Büro1
2014-06-23 18:27 - 2014-02-12 08:05 - 02091398 _____ () C:\windows\WindowsUpdate.log
2014-06-23 18:26 - 2014-02-12 09:11 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4255365308-323029514-2548571210-1001
2014-06-23 18:23 - 2012-12-31 02:23 - 00745562 _____ () C:\windows\system32\perfh007.dat
2014-06-23 18:23 - 2012-12-31 02:23 - 00169488 _____ () C:\windows\system32\perfc007.dat
2014-06-23 18:23 - 2012-07-26 09:28 - 01752720 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-23 18:16 - 2014-02-14 18:09 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\CrashDumps
2014-06-23 18:15 - 2014-06-23 18:15 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-06-23 18:15 - 2012-08-01 19:02 - 00189988 _____ () C:\windows\PFRO.log
2014-06-23 18:15 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\addins
2014-06-23 18:15 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-23 18:14 - 2014-06-16 14:13 - 00000000 ____D () C:\AdwCleaner
2014-06-23 18:14 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\BBI
2014-06-23 18:12 - 2014-06-23 18:12 - 00004252 _____ () C:\windows\system32\.crusader
2014-06-23 18:12 - 2014-06-23 18:08 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-23 18:02 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-06-23 18:01 - 2014-06-22 13:47 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-23 16:43 - 2014-06-23 16:43 - 676786988 _____ () C:\windows\MEMORY.DMP
2014-06-23 16:43 - 2014-06-23 16:43 - 00279600 _____ () C:\windows\Minidump\062314-30218-01.dmp
2014-06-23 16:43 - 2014-06-23 16:43 - 00000000 ____D () C:\windows\Minidump
2014-06-23 06:59 - 2014-06-23 18:01 - 00872008 _____ (Mindspark) C:\Program Files (x86)\8hUninstall Allin1Convert.dll
2014-06-23 06:59 - 2014-06-23 18:01 - 00197000 _____ () C:\Program Files (x86)\8hres.dll
2014-06-22 18:40 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-06-22 18:39 - 2012-07-26 11:45 - 00000000 ____D () C:\windows\SKB
2014-06-22 17:43 - 2014-06-22 17:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-06-22 17:41 - 2014-06-22 17:41 - 00020629 _____ () C:\ComboFix.txt
2014-06-22 17:41 - 2014-06-22 17:33 - 00000000 ____D () C:\Qoobox
2014-06-22 17:41 - 2014-04-23 06:56 - 00000000 ____D () C:\Users\dub_cm_auto
2014-06-22 17:41 - 2012-07-26 07:37 - 00000000 __RHD () C:\Users\Default
2014-06-22 17:39 - 2014-06-22 17:32 - 00000000 ____D () C:\windows\erdnt
2014-06-22 17:39 - 2012-07-26 07:26 - 00000215 _____ () C:\windows\system.ini
2014-06-22 17:31 - 2014-06-22 17:30 - 05209566 ____R (Swearware) C:\Users\Günter Krüger\Downloads\ComboFix.exe
2014-06-22 16:13 - 2014-02-15 13:57 - 04240258 _____ () C:\Users\Günter Krüger\Documents\vrexport.csv
2014-06-22 14:03 - 2014-06-13 12:26 - 00000000 ____D () C:\temp
2014-06-22 13:53 - 2014-06-22 13:17 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-22 13:47 - 2014-06-22 13:46 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-22 13:46 - 2014-06-22 13:46 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-22 13:38 - 2014-06-22 13:38 - 00001266 _____ () C:\Users\Günter Krüger\Desktop\Revo Uninstaller.lnk
2014-06-22 13:38 - 2014-06-22 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-22 13:37 - 2014-06-13 12:47 - 00000000 ____D () C:\Program Files (x86)\Easy Speed Check
2014-06-22 13:35 - 2014-06-15 13:25 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\Probit Software
2014-06-22 13:35 - 2014-06-13 12:46 - 00000000 ____D () C:\Program Files (x86)\Probit Software
2014-06-22 13:20 - 2014-06-22 13:17 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-22 13:18 - 2014-06-22 13:18 - 00001393 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00001381 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2014-06-22 13:18 - 2014-06-22 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-22 13:16 - 2014-06-22 13:16 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Günter Krüger\Downloads\spybot-2.3.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212.exe
2014-06-22 13:05 - 2014-06-22 13:05 - 01333465 _____ () C:\Users\Günter Krüger\Downloads\adwcleaner_3.212 (1).exe
2014-06-20 07:04 - 2014-02-15 16:19 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-18 12:56 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-06-16 18:14 - 2014-06-16 18:14 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Roaming\DesktopIconAmazon
2014-06-16 13:54 - 2014-06-13 12:29 - 00003132 _____ () C:\windows\System32\Tasks\System Speedup
2014-06-15 14:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\rescache
2014-06-15 13:30 - 2014-06-15 13:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-13 20:31 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\ELAMBKUP
2014-06-13 12:47 - 2014-06-13 12:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-13 12:47 - 2012-07-26 10:12 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-13 12:47 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-13 06:57 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-06-13 06:56 - 2014-02-15 13:34 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:54 - 2014-02-15 13:34 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-13 06:47 - 2014-02-21 07:51 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-06-13 06:47 - 2014-02-21 07:50 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-04 11:37 - 2014-02-12 08:05 - 00000000 ____D () C:\Users\Günter Krüger\AppData\Local\Packages
2014-05-31 07:16 - 2014-05-16 06:43 - 00703992 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-31 07:16 - 2014-05-16 06:43 - 00105464 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-24 04:48 - 2014-06-12 13:10 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-24 04:47 - 2014-06-12 13:10 - 02239488 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 01366016 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-05-24 04:47 - 2014-06-12 13:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 19290112 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 15368704 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 02650112 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-24 04:46 - 2014-06-12 13:10 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-24 04:45 - 2014-06-12 13:10 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-24 04:45 - 2014-06-12 13:10 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-24 04:45 - 2014-06-12 13:10 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 14365696 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-24 03:26 - 2014-06-12 13:10 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 13731328 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 02862080 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 02050560 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-05-24 03:25 - 2014-06-12 13:10 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-05-24 03:25 - 2014-06-12 13:10 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-05-24 03:09 - 2014-06-12 13:10 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-24 03:03 - 2014-06-12 13:10 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-24 00:37 - 2014-06-12 13:10 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
Some content of TEMP:
====================
C:\Users\Günter Krüger\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-22 14:31
==================== End Of Log ============================
--- --- ---
Addition: Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-06-2014
Ran by Günter Krüger at 2014-06-23 18:42:37
Running from C:\Users\Günter Krüger\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 Premier Edition (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 15.2.1 - Hewlett-Packard) Hidden
8500A909_eDocs (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
8500A909a (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
AMD Accelerated Video Transcoding (Version: 12.5.100.20821 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{DC7C952E-3B17-9BBE-CED0-152DB6B0BAA2}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AVerMedia TV Player (HKLM-x32\...\InstallShield_{DCF2CF72-8523-4487-9D55-31A6D53AEC57}) (Version: 1.8.1.13080201 - AVerMedia Technologies, Inc.)
AVerMedia TV Player (x32 Version: 1.8.1.13080201 - AVerMedia Technologies, Inc.) Hidden
BdB at work 2013 (HKLM-x32\...\BdB_at_Work_2005_is1) (Version: 2013 - LOGO Datensysteme GmbH)
Bing Bar (HKLM-x32\...\{3611CA6C-5FCA-4900-A329-6A118123CCFC}) (Version: 7.1.355.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BPD_DSWizards (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 6.30.59.49 - Broadcom Corporation)
Broadcom Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.6300 - Broadcom Corporation)
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0821.2158.37544 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0821.2159.37544 - Advanced Micro Devices, Inc.) Hidden
Connected Music powered by Universal Music Group version 1.0 (HKLM-x32\...\{46037DC7-F927-46DF-935F-D6F122BDD34B}_is1) (Version: 1.0 - Snowite)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.8 - REINER SCT)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1.5510 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1.5510 - CyberLink Corp.) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.1.1916 - CyberLink Corp.)
CyberLink Media Suite 10 (x32 Version: 10.0.1.1916 - CyberLink Corp.) Hidden
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.1.3109 - CyberLink Corp.)
CyberLink PhotoDirector (x32 Version: 2.0.1.3109 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.1.1902 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.1.1902 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.1.1925 - CyberLink Corp.)
CyberLink PowerDirector 10 (x32 Version: 10.0.1.1925 - CyberLink Corp.) Hidden
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.1.4407 - CyberLink Corp.)
CyberLink PowerDVD (x32 Version: 10.0.1.4407 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.4.5527 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.4.5527 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Energy Star (HKLM\...\{0FA995CC-C849-4755-B14B-5404CC75DC24}) (Version: 1.0.8 - Hewlett-Packard)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Fax (x32 Version: 140.0.307.000 - Hewlett-Packard) Hidden
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
Hewlett-Packard ACLM.NET v1.2.0.0 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)
HP Connected Remote (HKLM-x32\...\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1206 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP My Display (HKLM-x32\...\{1F4DDC90-5923-4E49-A4C7-F3CCC954DCA0}) (Version: 1.12.004 - Portrait Displays, Inc.)
HP Officejet Pro 8500 A909 Series (HKLM\...\{49C2B7C1-A4E7-4770-8E30-255795AD4712}) (Version: 14.0 - HP)
HP Officejet Pro X476dw MFP - Grundlegende Software für das Gerät (HKLM\...\{B891D4EC-FAE9-4BCC-810F-D6E764B0F3E1}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Officejet Pro X476dw MFP Hilfe (HKLM-x32\...\{2DB9C60D-9DB6-4C3C-A791-B0291EE49C83}) (Version: 29.0.0 - Hewlett Packard)
HP Postscript Converter (Version: 3.1.3591 - Hewlett-Packard) Hidden
HP Quick Start (HKLM-x32\...\{BB27C290-AB30-4D9E-A5D1-88745AAE42E9}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Registration Service (HKLM\...\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Support Assistant (HKLM-x32\...\{FF27F674-821E-4BA2-985B-DDF539C2CD03}) (Version: 7.0.33.6 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
HydraVision (x32 Version: 4.2.236.0 - Advanced Micro Devices, Inc.) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6435.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.757.1 - Intel Corporation) Hidden
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4623.1003 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MPM (HKLM-x32\...\{8AEA6737-8AF3-47BB-95CE-AAB62BE68985}) (Version: 1.00.0000 - Hewlett-Packard)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.3.0.12 - Symantec Corporation)
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Pivot Pro Plugin (x32 Version: 9.50.110 - Portrait Displays, Inc.) Hidden
ProductContext (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.15.410.2013 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{0D61A55C-3ADC-409F-BF5B-A1766D1F5944}) (Version: 6.2.9200.28137 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
SDK (x32 Version: 2.28.007 - Portrait Displays, Inc.) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Studie zur Verbesserung von HP Officejet Pro X476dw MFP (HKLM\...\{0F44954A-5793-40DF-9357-9EEC3E475EF1}) (Version: 29.1.973.39397 - Hewlett-Packard Co.)
TeamViewer 5 (HKLM-x32\...\TeamViewer 5) (Version: 5.1.17330 - TeamViewer GmbH)
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
VR-NetWorld (HKLM-x32\...\{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}) (Version: - )
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
==================== Restore Points =========================
03-06-2014 05:19:01 Geplanter Prüfpunkt
10-06-2014 05:31:10 Geplanter Prüfpunkt
18-06-2014 05:03:06 Geplanter Prüfpunkt
22-06-2014 11:40:06 Revo Uninstaller's restore point - sweet-page uninstall
22-06-2014 11:42:28 Revo Uninstaller's restore point - Easy Speed Check
23-06-2014 16:11:51 Prüfpunkt von HitmanPro
==================== Hosts content: ==========================
2012-07-26 07:26 - 2014-06-22 17:39 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {34A6D71C-B0A5-4E95-8FBB-C024A02671E7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-08-15] (Hewlett-Packard Company)
Task: {3688527B-79D0-43A5-8367-5F8BC0FBEF7F} - \EPUpdater No Task File <==== ATTENTION
Task: {41CAEC9F-9C87-4097-BF32-4A1FBD89267C} - \PC Speed Maximizer Schedule No Task File <==== ATTENTION
Task: {58775D6C-4C0E-4949-A466-CD58D12479E7} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)
Task: {69244028-F07E-409E-9284-424394972A28} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {765A4E3A-ABFC-4F5F-AA75-E2D7D37011A2} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Büro1-Günter Krüger Büro1 => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-06-20] (Microsoft Corporation)
Task: {7A1FF1A2-F21B-4717-9B88-FED27B956196} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {840F7251-1F04-4FE4-AA06-0FB0D2C44F8E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-08-15] (Hewlett-Packard Company)
Task: {85147162-114E-49A8-BB7D-D99BDB122A17} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\SymErr.exe
Task: {8564A42E-F2DA-4C52-AF2F-CFC7EC10D764} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2014-06-13] (Microsoft Corporation)
Task: {8BED10A7-A9E4-4E8C-B08F-AA939448AAA0} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {9218D5FA-6CB2-47AB-8CE4-4E2E2288B6FB} - \BlockAndSurf Update No Task File <==== ATTENTION
Task: {97D95D07-9922-45E3-B7D2-6C9B5860D32E} - System32\Tasks\HPCustParticipation HP Officejet Pro X476dw MFP => C:\Program Files\HP\HP Officejet Pro X476dw MFP\Bin\HPCustPartic.exe [2012-10-30] (Hewlett-Packard Co.)
Task: {9F6AC726-4C40-4B30-8217-07D2D6072C28} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)
Task: {A2225059-743B-4C03-B8A9-54D4FA1D8EF1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2012-07-13] (Hewlett-Packard)
Task: {A4EE4CA6-1A0E-42FE-A7AD-08070A416C95} - \BlockAndSurf_wd No Task File <==== ATTENTION
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {A7460DC5-CDD5-4003-9979-D73BC1A9E960} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {AF70A4C2-36DA-40FD-AC9C-623538989CE9} - System32\Tasks\System Speedup => C:\Program Files (x86)\System Speedup\SystemSpeedup.exe
Task: {B2CCB8F0-D10C-4870-B1F5-886BB07EC772} - \System Speedup_DEFAULT No Task File <==== ATTENTION
Task: {B808A6F4-0E9C-4480-8AFC-9BE5D01A9B6A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\WSCStub.exe [2014-05-11] (Symantec Corporation)
Task: {B99A160A-CF4A-4E43-A4DE-3BC83D0424BE} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {C34C5E8E-0646-4B9D-8A0B-D853AF9860F0} - \System Speedup_UPDATES No Task File <==== ATTENTION
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {C71E4F00-4EE0-4111-A226-F086728F3B99} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\SymErr.exe
Task: {C8B478C6-66A5-4D94-B9C6-89E507E36719} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {D583A18D-2141-4095-ACEB-337B76F0B47A} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {E108E082-B1D7-47BF-A9CE-C2D16FD56A67} - \Advanced System Protector_startup No Task File <==== ATTENTION
Task: {E66DBD2B-AB74-4DD7-AA7D-524479520010} - \LaunchApp No Task File <==== ATTENTION
Task: {E8D25E8F-F0F2-4E79-B3BB-4331EA4FF7EB} - \Advanced System Protector No Task File <==== ATTENTION
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {FC3E7E89-EBD5-4FA1-8A27-5DE43726143E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-08-15] (Hewlett-Packard Company)
==================== Loaded Modules (whitelisted) =============
2014-02-21 09:15 - 2014-02-21 09:13 - 00772096 _____ () c:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
2013-03-22 13:27 - 2013-03-22 13:27 - 00049368 _____ () c:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll
2014-03-19 08:32 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-02-21 09:15 - 2014-02-21 09:13 - 00163840 _____ () C:\Program Files (x86)\Common Files\AVerMedia\AVerHIDReceiver\AVerHIDReceiver.exe
2012-12-30 17:42 - 2010-05-13 18:34 - 00674928 _____ () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
2012-08-21 23:57 - 2012-08-21 23:57 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-05-04 18:42 - 2012-05-04 18:42 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2012-05-04 18:42 - 2012-05-04 18:42 - 00028672 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResourcesNet4.dll
2012-08-29 12:02 - 2012-08-29 12:02 - 00120224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesModule.dll
2012-08-29 12:02 - 2012-08-29 12:02 - 00048544 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesProxy.dll
2012-08-29 12:02 - 2012-08-29 12:02 - 00180224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\zxing.dll
2014-02-12 09:07 - 2014-02-12 09:07 - 00120224 _____ () C:\Users\Günter Krüger\AppData\Local\assembly\dl3\NVKYM7VA.POW\O1GTHLKR.RTH\78274c9c\0017145d_cd85cd01\HPItunesModule.DLL
2014-06-23 18:39 - 2014-06-23 18:39 - 00050477 _____ () C:\Users\Günter Krüger\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3PQGC9T\Defogger.exe
2014-02-21 09:15 - 2014-02-21 09:13 - 00053248 _____ () c:\Program Files (x86)\Common Files\AVerMedia\dll\MsgLog.DLL
2014-06-22 13:17 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-22 13:17 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-22 13:17 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-22 13:17 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-22 13:17 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-12-30 17:45 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 13:34 - 2012-06-08 13:34 - 00016400 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-02-21 09:01 - 2014-02-21 09:01 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
Name: Officejet Pro 8500 A909a
Description: Officejet Pro 8500 A909a
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: HP Officejet Pro X476dw MFP
Description: HP Officejet Pro X476dw MFP
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/23/2014 06:16:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OSDManager.exe, Version: 1.0.0.1, Zeitstempel: 0x502d8818
Name des fehlerhaften Moduls: mshtml.dll, Version: 10.0.9200.16921, Zeitstempel: 0x537fddb8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001150a4
ID des fehlerhaften Prozesses: 0x17cc
Startzeit der fehlerhaften Anwendung: 0xOSDManager.exe0
Pfad der fehlerhaften Anwendung: OSDManager.exe1
Pfad des fehlerhaften Moduls: OSDManager.exe2
Berichtskennung: OSDManager.exe3
Vollständiger Name des fehlerhaften Pakets: OSDManager.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: OSDManager.exe5
Error: (06/23/2014 06:16:24 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet. 0x0.
Error: (06/23/2014 06:16:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Kontext: Anwendung, SystemIndex Katalog
Error: (06/23/2014 06:16:20 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet. 0x0.
Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Die Leistungsüberwachung für den Gatherer-Dienst kann nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Kontext: Anwendung, SystemIndex Katalog
Error: (06/23/2014 04:44:21 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description: Die Leistungsüberwachung kann für den Gatherer-Dienst nicht initialisiert werden, da die Datenquellen nicht geladen sind oder das freigegebene Speicherobjekt nicht geöffnet werden konnte. Dies beeinträchtigt lediglich die Verfügbarkeit der Leistungsindikatoren. Starten Sie den Computer erneut.
Error: (06/23/2014 04:03:10 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8
Error: (06/23/2014 01:34:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16921, Zeitstempel: 0x537fc9dc
Name des fehlerhaften Moduls: atidxx32.dll, Version: 8.17.10.451, Zeitstempel: 0x50344246
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000624f2
ID des fehlerhaften Prozesses: 0x144c
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5
Error: (06/23/2014 09:30:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OSDManager.exe, Version: 1.0.0.1, Zeitstempel: 0x502d8818
Name des fehlerhaften Moduls: mshtml.dll, Version: 10.0.9200.16921, Zeitstempel: 0x537fddb8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001150a4
ID des fehlerhaften Prozesses: 0x1674
Startzeit der fehlerhaften Anwendung: 0xOSDManager.exe0
Pfad der fehlerhaften Anwendung: OSDManager.exe1
Pfad des fehlerhaften Moduls: OSDManager.exe2
Berichtskennung: OSDManager.exe3
Vollständiger Name des fehlerhaften Pakets: OSDManager.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: OSDManager.exe5
System errors:
=============
Error: (06/23/2014 06:18:31 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.
Error: (06/23/2014 06:18:21 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.
Error: (06/23/2014 06:15:56 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit dem folgenden dienstspezifischen Fehler beendet:
%%0
Error: (06/23/2014 06:14:35 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.
Error: (06/23/2014 04:46:30 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.
Error: (06/23/2014 04:46:24 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.
Error: (06/23/2014 04:43:48 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000133 (0x0000000000000001, 0x0000000000001e00, 0x0000000000000000, 0x0000000000000000)C:\windows\MEMORY.DMP062314-30218-01
Error: (06/23/2014 04:43:46 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 23.06.2014 um 16:11:28 unerwartet heruntergefahren.
Error: (06/22/2014 06:42:42 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.
Error: (06/22/2014 06:42:36 PM) (Source: Schannel) (EventID: 4102) (User: NT-AUTORITÄT)
Description: Schwerwiegender Fehler beim Zugriff auf den privaten Schlüssel der Anmeldeinformationen Server für SSL. Der vom kryptografischen Modul zurückgegebene Fehlercode lautet 0x8009030d. Der interne Fehlerstatus ist 10001.
Microsoft Office Sessions:
=========================
Error: (06/23/2014 06:16:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OSDManager.exe1.0.0.1502d8818mshtml.dll10.0.9200.16921537fddb8c0000005001150a417cc01cf8efe86f8cd5fC:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exeC:\Windows\SYSTEM32\mshtml.dllc8a10873-faf1-11e3-be8b-9cb70dd018d4
Error: (06/23/2014 06:16:24 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: WSearchIdxPiDer Vorgang wurde erfolgreich beendet. 0x0
Error: (06/23/2014 06:16:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Error: (06/23/2014 06:16:20 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description:
Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 10021) (User: )
Description: WSearchIdxPiDer Vorgang wurde erfolgreich beendet. 0x0
Error: (06/23/2014 04:44:23 PM) (Source: Windows Search Service) (EventID: 3007) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Error: (06/23/2014 04:44:21 PM) (Source: Windows Search Service) (EventID: 3006) (User: )
Description:
Error: (06/23/2014 04:03:10 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll8
Error: (06/23/2014 01:34:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE10.0.9200.16921537fc9dcatidxx32.dll8.17.10.45150344246c0000005000624f2144c01cf8ed6d73bb753C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\windows\SYSTEM32\atidxx32.dll4f00f9c9-faca-11e3-be89-9cb70dd018d4
Error: (06/23/2014 09:30:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: OSDManager.exe1.0.0.1502d8818mshtml.dll10.0.9200.16921537fddb8c0000005001150a4167401cf8eb4febfe0a5C:\Program Files (x86)\Hewlett-Packard\HP My Display\OSDManager.exeC:\Windows\SYSTEM32\mshtml.dll3e801f70-faa8-11e3-be89-9cb70dd018d4
CodeIntegrity Errors:
===================================
Date: 2014-06-22 17:39:00.971
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Memory info ===========================
Percentage of memory in use: 29%
Total physical RAM: 6080.82 MB
Available physical RAM: 4268.98 MB
Total Pagefile: 12224.82 MB
Available Pagefile: 10153.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:1849.7 GB) (Free:1797.36 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:11.84 GB) (Free:1.41 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (USB DISK) (Removable) (Total:0.94 GB) (Free:0.89 GB) FAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 246AE139)
Partition: GPT Partition Type.
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 968 MB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=967 MB) - (Type=06)
==================== End Of Log ============================
Da ich mit meinem Latein am Ende bin, hoffe ich dass ihr mir helfen könnt.
Vielen Dank
//edit: Das ist ein Rechner im Büro. Da ein Kleinunternehmen -> keine IT. Ich kenne mich etwas damit aus. Aber wie man sieht hat ja bisher alles nichts geholfen. |
Malwarebytes Anti-Malware 
SecurityCheck und:
