Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet. (https://www.trojaner-board.de/157274-e-mail-anhang-unsersoesen-absenders-heruntergeladen-7-zip-geoeffnet.html)

Thunder2001 05.08.2014 19:50
E-Mail Anhang eines unsersösen Absenders heruntergeladen und mit 7 Zip geöffnet.
 
Servus.

Jetzt hat es auch mal meinen PC erwischt, leider.
Es wurde ein E-Mail Anhang einer angeblich von Paypal stammenden E-Mail direkt aus Thunderbird in 7zip geöffnet (.zip archiv). Das Fenster wurde danach sofort wieder geschlossen und kein Inhalt des Archivs geöffnet oder angeklickt (es befand sich die selbe zip Datei nochmals in dem Archiv)

Der Scan mittels VirusTotal brachte direkt 9 Ergebnisse, heute schon 19 Scanner die meinen das wäre eine böse Datei :) (Screenshot in VT.jpg)

Ich habe den PC schon über Nacht mittels Avira und Bitdefender gescannt (auf der ct desinfect 2014 CD ), sowie mit Malwarebytes, aber die haben nichts gefunden.

Im Betrieb habe ich bis jetzt keine Besonderheiten festgestellt. Alles ist gleich schnell wie vorher, keine Verbindung dir plötzlich nach draußen will, aber ich dachte mir, gehst du mal lieber auf Nummer sicher und fragst jemanden, der sich damit besser auskennt.


Ich bedanke mich schon einmal im Vorraus für die Hilfe. :dankeschoen:

schrauber 05.08.2014 20:13
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Thunder2001 05.08.2014 20:19
Tut mir Leid, blöde Angewohnheit :)

defogger log:
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:17 on 05/08/2014 (Thunderhawk)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Thunderhawk (administrator) on THUNDER-PC on 05-08-2014 20:22:17
Running from C:\Users\Thunderhawk\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Hi-Rez Studios) E:\Spiele\Hi-Rez Studios\HiPatchService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Secomba GmbH) C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Spotify Ltd) C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CTxfispi.exe
() C:\Users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10464536 2014-07-02] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [CTxfiHlp] => CTXFIHLP.EXE
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Plantronics MyHeadset Updater] => C:\Program Files (x86)\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe [79872 2014-04-29] (Plantronics)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [PLTSpokes.exe] => C:\Program Files (x86)\Plantronics\Spokes3G\PLTSpokes.exe -min
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [BoxcryptorClassic.exe] => C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe [2249472 2014-07-11] (Secomba GmbH)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [KeePass Password Safe 2] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [Spotify Web Helper] => C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-29] (Spotify Ltd)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [RocketDock] => "C:\Program Files (x86)\RocketDock\RocketDock.exe"
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [SteelSeries Engine] => C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe [252928 2014-04-15] (SteelSeries ApS)
IFEO\utilman.exe: [Debugger] c:\windows\system32\cmd.exe
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (No File)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starteFraps.bat ()
SSODL: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x020D68C2C09FCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: [NameServer]192.168.179.1

FireFox:
========
FF ProfilePath: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default
FF Homepage: http://www.trojaner-board.de/69886-a...-beachten.html
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*'))%20%7B%20return%20'PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\idealode.xml
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\youtube.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: CLEO - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\CLEO@guid.customsoftwareconsult.com [2014-07-01]
FF Extension: HTTPS-Everywhere - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\https-everywhere@eff.org [2014-06-28]
FF Extension: Pocket - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\isreaditlater@ideashower.com [2014-07-04]
FF Extension: KeeFox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\keefox@chris.tomlinson [2014-06-11]
FF Extension: NetVideoHunter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\netvideohunter@netvideohunter.com [2014-07-30]
FF Extension: FEBE - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2014-06-11]
FF Extension: Converter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{8B72860F-C5F8-4286-865E-D2C2DB98A9E6} [2014-03-26]
FF Extension: DownloadHelper - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-26]
FF Extension: ImageHost Grabber - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2014-03-26]
FF Extension: about:addons-memory - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\about-addons-memory@tn123.org.xpi [2014-03-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-03-26]
FF Extension: Brief - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\brief@mozdev.org.xpi [2014-03-26]
FF Extension: FurAffinity Extender - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\faextender@neocodenetworks.com.xpi [2014-03-26]
FF Extension: Firebug - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firebug@software.joehewitt.com.xpi [2014-03-26]
FF Extension: Grooveshark Remote - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefox@gsremote.com.xpi [2014-03-26]
FF Extension: Bookmarks Checker - check for bad links - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-03-26]
FF Extension: Furaffinity Download extension for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\fuerholz@gmx.net.xpi [2014-03-26]
FF Extension: BetterTTV - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-OeCFXKAPh2tC0bN3Li9ajRAZx6c@jetpack.xpi [2014-05-25]
FF Extension: Magic Actions for YouTube™ - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi [2014-03-26]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-03-26]
FF Extension: Dict.cc Translation - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\searchdictcc@roughael.xpi [2014-03-26]
FF Extension: ShareMeNot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\sharemenot@franziroesner.com.xpi [2014-03-26]
FF Extension: Smart Referer - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\smart-referer@meh.paranoid.pk.xpi [2014-03-26]
FF Extension: Lyrics Here by Rob W - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\youtube-lyrics-by-rob-w@jetpack.xpi [2014-03-26]
FF Extension: Locator - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff}.xpi [2014-03-26]
FF Extension: FlashGot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-03-26]
FF Extension: Cookie Monster - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2014-03-26]
FF Extension: eBay Sidebar for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2014-03-26]
FF Extension: NoScript - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-26]
FF Extension: Tab Mix Plus - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-03-26]
FF Extension: DownThemAll! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-26]
FF Extension: Greasemonkey - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-03-26]
FF Extension: Adblock Edge - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-05]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-06-26] (Perfect World Entertainment Inc)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-07-14] ()
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [294912 2010-09-30] (Creative Technology Ltd) [File not signed]
S3 DAUpdaterSvc; E:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2011-05-04] (BioWare)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
U2 HiPatchService; E:\Spiele\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2014-06-05] (The OpenVPN Project)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [72344 2008-02-17] (SiSoftware) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 CSRBC; C:\Windows\System32\Drivers\csrbcx64.sys [38400 2014-04-04] (CSR plc.)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-28] (Disc Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-05] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2014-04-09] (Razer Inc)
R3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-27] (Duplex Secure Ltd.)
S3 SteelSeriesDriver; C:\Windows\System32\DRIVERS\ssengine.sys [24064 2013-11-14] () [File not signed]
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 20:21 - 2014-08-05 20:22 - 00030465 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 19:57 - 2014-08-05 20:22 - 00000000 ____D () C:\FRST
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:57 - 2014-08-02 11:06 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-05 19:03 - 2014-08-05 20:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 19:02 - 2014-08-05 19:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-05 19:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 18:54 - 2014-08-05 19:02 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-03 21:20 - 2014-08-04 18:24 - 00006970 _____ () C:\Windows\PFRO.log
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 18:39 - 2014-08-03 18:39 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PackageAware
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 17:18 - 2014-08-02 17:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-08-02 17:16 - 2014-07-02 20:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-08-02 17:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 17:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-08-02 17:15 - 2014-07-02 23:29 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-02 17:15 - 2014-07-02 23:29 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-02 17:15 - 2014-07-02 23:29 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 17:15 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03196816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00965312 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb
2014-08-02 17:15 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-02 17:15 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-02 17:15 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-02 15:43 - 2014-08-02 16:22 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-05 20:18 - 00002359 _____ () C:\Windows\setupact.log
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-30 20:32 - 2014-07-30 21:04 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-27 19:32 - 2014-07-27 19:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-21 21:50 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-21 21:50 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-21 21:50 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-19 18:10 - 2014-07-21 22:20 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:00 - 2014-07-19 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:32 - 2014-07-27 01:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 19:43 - 2014-07-14 19:44 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:23 - 2014-07-14 16:27 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:18 - 2014-07-14 16:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:26 - 2014-08-03 13:24 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-07-13 00:23 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-13 00:23 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-13 00:23 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-13 00:23 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-13 00:23 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-13 00:23 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-13 00:23 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-13 00:23 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-13 00:23 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-13 00:23 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-13 00:23 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-13 00:23 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-13 00:23 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-13 00:23 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-13 00:23 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-13 00:23 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-13 00:23 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-13 00:23 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-13 00:23 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-13 00:23 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-13 00:23 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-13 00:23 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-13 00:23 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-13 00:23 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-13 00:23 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-13 00:23 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-13 00:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-13 00:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-13 00:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 20:22 - 2014-08-05 20:21 - 00030465 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-05 20:22 - 2014-08-05 19:57 - 00000000 ____D () C:\FRST
2014-08-05 20:22 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\NetSpeedMonitor
2014-08-05 20:21 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 20:21 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 20:19 - 2014-08-05 19:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 20:19 - 2014-05-12 01:28 - 00000000 ___RD () C:\Users\Thunderhawk\Dropbox
2014-08-05 20:19 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Dropbox
2014-08-05 20:18 - 2014-08-02 14:04 - 00002359 _____ () C:\Windows\setupact.log
2014-08-05 20:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 20:17 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\KeePass
2014-08-05 20:17 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk
2014-08-05 20:17 - 2014-01-25 21:06 - 01354467 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 20:08 - 2014-01-25 23:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-05 20:01 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\vlc
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:40 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-05 19:40 - 2014-03-23 14:04 - 00000000 ____D () C:\Program Files\WinRAR
2014-08-05 19:36 - 2011-04-12 09:43 - 00709786 _____ () C:\Windows\system32\perfh007.dat
2014-08-05 19:36 - 2011-04-12 09:43 - 00154116 _____ () C:\Windows\system32\perfc007.dat
2014-08-05 19:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\VMware
2014-08-05 19:34 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\VMware
2014-08-05 19:08 - 2014-03-08 23:24 - 00000000 ____D () C:\TEMP
2014-08-05 19:07 - 2014-04-19 19:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Networking Course
2014-08-05 19:03 - 2014-08-05 19:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:03 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Malwarebytes
2014-08-05 19:02 - 2014-08-05 18:54 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 19:02 - 2009-07-14 07:13 - 01657044 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 18:58 - 2014-01-31 14:43 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 01:24 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\TS3Client
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-04 18:24 - 2014-08-03 21:20 - 00006970 _____ () C:\Windows\PFRO.log
2014-08-04 00:57 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\JDownloader v2.0
2014-08-03 21:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-08-03 20:52 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Free Download Manager
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 18:39 - 2014-08-03 18:39 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PackageAware
2014-08-03 17:30 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Deployment
2014-08-03 17:00 - 2014-03-26 14:45 - 00002240 ____H () C:\Users\Thunderhawk\Documents\Default.rdp
2014-08-03 16:48 - 2014-02-23 18:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-03 14:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-03 13:24 - 2014-07-14 15:26 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-08-03 13:24 - 2014-04-06 15:27 - 00000000 ____D () C:\Users\Thunderhawk\.minion
2014-08-03 13:10 - 2014-01-31 13:06 - 00000000 ____D () C:\Program Files\Logitech Gaming Software
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 18:12 - 2014-03-26 16:14 - 00000000 ____D () C:\Program Files (x86)\Samsung Magician
2014-08-02 18:01 - 2014-03-09 16:05 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-02 17:22 - 2014-08-02 17:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:22 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA Corporation
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-01-25 22:39 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 17:18 - 2014-01-25 22:38 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 16:22 - 2014-08-02 15:43 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-02 11:06 - 2014-08-05 19:57 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-01 19:09 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\DAEMON Tools Lite
2014-07-31 15:24 - 2014-02-04 21:13 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-30 21:04 - 2014-07-30 20:32 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-30 19:26 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Thunderbird
2014-07-30 19:18 - 2014-01-25 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-27 19:41 - 2014-07-27 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-27 01:28 - 2014-07-15 17:32 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-26 21:26 - 2014-03-26 14:46 - 00581038 _____ () C:\Users\Thunderhawk\Documents\Thunder.kdbx
2014-07-26 21:25 - 2014-03-26 14:46 - 00000000 ____D () C:\Users\Thunderhawk\Documents\my games
2014-07-26 20:20 - 2014-04-13 14:24 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Roaming\winscp.rnd
2014-07-26 19:40 - 2014-03-26 14:41 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Local\PUTTY.RND
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-26 01:10 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 16:01 - 2014-08-02 17:18 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 22:20 - 2014-07-19 18:10 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-01-25 23:39 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:11 - 2014-07-19 17:00 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 17:01 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-19 12:30 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\.minecraft
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 13:02 - 2014-04-13 14:21 - 00000986 _____ () C:\Users\Public\Desktop\WinSCP.lnk
2014-07-17 13:02 - 2014-04-13 14:21 - 00000000 ____D () C:\Program Files (x86)\WinSCP
2014-07-17 13:01 - 2014-01-25 21:59 - 01677000 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-15 16:10 - 2014-01-31 13:10 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-07-14 19:44 - 2014-07-14 19:43 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:27 - 2014-07-14 16:23 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:23 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArmA 2
2014-07-14 16:22 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:34 - 2014-05-27 20:22 - 00000058 _____ () C:\Users\Thunderhawk\Desktop\Neues Textdokument.txt
2014-07-13 21:02 - 2009-07-14 06:45 - 00394536 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-13 00:33 - 2014-01-25 22:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-13 00:30 - 2014-01-25 22:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-11 03:02 - 2014-07-21 21:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-11 02:56 - 2014-07-21 21:50 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-11 02:56 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-11 02:55 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-09 15:39 - 2014-03-23 18:45 - 00000000 ____D () C:\Program Files (x86)\RocketDock
2014-07-09 15:27 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-09 15:26 - 2014-01-25 23:42 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:26 - 2014-01-25 23:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:26 - 2014-01-25 23:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-08 20:08 - 2014-05-14 13:08 - 05659136 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk
2014-07-08 17:53 - 2014-01-25 23:57 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2

Some content of TEMP:
====================
C:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpopswjk.dll
C:\Users\Thunderhawk\AppData\Local\Temp\InstHelper.exe
C:\Users\Thunderhawk\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Thunderhawk\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Thunderhawk\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Thunderhawk\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Thunderhawk\AppData\Local\Temp\nvStInst.exe
C:\Users\Thunderhawk\AppData\Local\Temp\proxy_vole5180237192143850281.dll
C:\Users\Thunderhawk\AppData\Local\Temp\r9umkqjc.dll
C:\Users\Thunderhawk\AppData\Local\Temp\Samsung_Magician_Setup_v44.exe
C:\Users\Thunderhawk\AppData\Local\Temp\tap-windows.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-31 15:01

==================== End Of Log ============================
--- --- ---

--- --- ---

Thunder2001 05.08.2014 20:23
Additions.log:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-08-2014
Ran by Thunderhawk at 2014-08-05 20:22:42
Running from C:\Users\Thunderhawk\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personal Firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.32 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0932-000001000000}) (Version: 9.32.00.0 - Igor Pavlov)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\{BCFB58FF-181E-472F-A9DB-827B75C1EDF7}) (Version: 12.0.4.144 - Adobe Systems, Inc)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Allgemeine Runtime Files (x86) (HKLM\...\{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1) (Version: 1.0.3.6 - Sereby Corporation)
Antichamber (HKLM-x32\...\Steam App 219890) (Version:  - Alexander Bruce)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
Archeage Beta (HKLM-x32\...\Glyph Archeage Beta) (Version:  - Trion Worlds, Inc.)
Auslogics DiskDefrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 4.5.2.0 - Auslogics Labs Pty Ltd)
AutoIt v3.3.10.2 (HKLM-x32\...\AutoItv3) (Version: 3.3.10.2 - AutoIt Team)
Banking 4W (HKLM-x32\...\TopBanking) (Version:  - Subsembly GmbH)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bound By Flame (HKLM-x32\...\Bound By Flame_is1) (Version:  - )
Boxcryptor Classic 1.7 (HKLM-x32\...\{89380595-CE5F-4C32-A8BE-E5D1079FC701}) (Version: 1.7.407.129 - Secomba GmbH)
Canon MP Navigator EX 5.1 (HKLM-x32\...\MP Navigator EX 5.1) (Version:  - )
Canon MX710 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX710_series) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version:  - Cheat Engine)
CM Installer (HKLM-x32\...\{681544C2-FFA2-4CFD-A9AD-2A3D25DF8D22}) (Version: 1.0.0.0 - Cyanogen Inc.)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 33.1.0.0 - COMODO)
CONSORTIUM Update v1.1 (HKLM-x32\...\Q09OU09SVElVTQ==_is1) (Version: 1 - )
Creative ALchemy (HKLM-x32\...\ALchemy) (Version: 1.43 - Creative Technology Limited)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 3.00 - Creative Technology Limited)
Creative AutoMode Switcher (HKLM-x32\...\Creative AutoMode Switcher) (Version: 1.00 - Creative Technology Limited)
Creative Konsole Starter (HKLM-x32\...\Console Launcher) (Version: 2.61 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version:  - )
Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.810 - Curse)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.7 - REINER SCT)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
DayZ Commander (HKLM-x32\...\{B3653588-3AC0-4A1D-950F-D96531E84374}) (Version: 0.92.91 - Dotjosh Studios)
DC Universe Online (HKLM-x32\...\Steam App 24200) (Version:  - Sony Online Entertainment)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)
Dogecoin (HKCU\...\Dogecoin) (Version: 1.6.0.0 - Dogecoin)
Dragons Prophet (HKCU\...\SOE-Dragons Prophet) (Version:  - Sony Online Entertainment)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)
Dust: An Elysian Tail (HKLM-x32\...\Steam App 236090) (Version:  - Humble Hearts LLC)
ESET Smart Security (HKLM\...\{23234C01-F6B0-40FE-A583-B66840B28445}) (Version: 7.0.317.4 - ESET, spol s r. o.)
Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.05 - Ubisoft)
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free Download Manager 3.9.4 (HKLM-x32\...\Free Download Manager_is1) (Version:  - FreeDownloadManager.ORG)
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FRITZ!Fernzugang (HKLM\...\{DD57CC22-8864-4CCA-94D4-600D024C1207}) (Version: 1.3.1 - AVM Berlin)
Gameforge Live 1.10.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.10.0 - Gameforge)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Glyph (HKLM-x32\...\Glyph) (Version:  - Trion Worlds, Inc.)
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version:  - EFD Software)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
InfiniteCrisis_EA652746A1A8 (HKLM-x32\...\InfiniteCrisis_EA652746A1A8) (Version:  - Turbine, Inc)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
Intel® SSD Toolbox (HKLM-x32\...\{06D085C8-1F00-11B2-96A7-8f0CE39193ED}) (Version: 3.2.1.400 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.650 - Oracle)
Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
KeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)
Kingdoms of Amalur: Reckoning™ (HKLM-x32\...\Steam App 102500) (Version:  - Big Huge Games)
Lautstärkefenster (HKLM-x32\...\Creative Volume Panel) (Version: 2.21 - Creative Technology Limited)
LibreOffice 4.2 Help Pack (German) (HKLM-x32\...\{DA6AF414-24FA-4815-A4FB-5EFD6173E6F5}) (Version: 4.2.4.2 - The Document Foundation)
LibreOffice 4.2.5.2 (HKLM-x32\...\{8D8F47B2-0E03-4C50-9803-A01120878F96}) (Version: 4.2.5.2 - The Document Foundation)
Livestreamer 1.7.3 (HKLM-x32\...\Livestreamer) (Version:  - )
Loadout (HKLM-x32\...\Steam App 208090) (Version:  - Edge of Reality)
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.53 (HKLM\...\Logitech Gaming Software) (Version: 8.53.186 - Logitech Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1036 - Marvell)
Marvell Miniport Driver (HKLM-x32\...\Marvell Miniport Driver) (Version: 11.45.4.3 - Marvell)
Mass Effect™ 3 (HKLM-x32\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
Metro Last Light (HKLM-x32\...\Metro Last Light_is1) (Version: 2.0.0.0 - )
Metro Last Light Update 12 (v1.0.0.14) Plus limited First Edition DLCs Plus Chronicles Pack DLC v1.0.0.14 (HKLM-x32\...\Metro Last Light Update 12 (v1.0.0.14) Plus limited First Edition DLCs Plus Chronicles Pack DLC v1.0.0.14) (Version:  - )
Microsoft .NET Compact Framework 3.5 (HKLM-x32\...\{291B3A3B-F808-45B8-8113-DF232FCB6C82}) (Version: 3.5.7283 - Microsoft Corporation)
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM-x32\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM-x32\...\M2833941) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM-x32\...\M979906) (Version:  - )
Microsoft .NET Framework 1.1 SP1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version:  - )
Microsoft .NET Framework 1.1 SP1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61186 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60830 (HKLM-x32\...\{9dba0447-b749-41ea-90bc-2aa19a9eb580}) (Version: 11.0.60830.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60830 (x32 Version: 11.0.60830 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60830 (x32 Version: 11.0.60830 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version:  - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (Version: 2.0.50728 - Microsoft Corporation) Hidden
Microsoft Windows Performance Toolkit (HKLM\...\{E7F9E526-2324-437B-A609-E8C5309465CB}) (Version: 4.8.0 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (HKLM\...\SDKSetup_7.1.7600.0.30514) (Version: 7.1.7600.0.30514 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.1) (Version: 7.1.30514 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Might and Magic X Legacy (HKLM-x32\...\TWlnaHRhbmRNYWdpY1hMZWdhY3k=_is1) (Version: 1 - )
Minion (HKCU\...\{Minion}}_is1) (Version: 2.0 - ZAM Network LLC)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 31.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.0 (x86 de)) (Version: 31.0 - Mozilla)
MusicBee 2.3 (HKLM-x32\...\MusicBee) (Version: 2.3 - Steven Mayall)
My Game Long Name (HKLM\...\UDK-7648aaf4-ab93-444c-a725-b455cf914f7a) (Version:  - Epic Games, Inc.)
My Game Long Name (HKLM\...\UDK-8d232e0e-ead5-4c80-b1a9-3dd4c68adb25) (Version:  - Epic Games, Inc.)
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.19.0 - NEC Electronics Corporation)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.7 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 15.3.33 (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 15.3.33 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenVPN 2.3.4-I002  (HKLM-x32\...\OpenVPN) (Version: 2.3.4-I002 - )
Origin (HKLM-x32\...\Origin) (Version: 9.4.5.195 - Electronic Arts, Inc.)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.9.3 - pdfforge)
Peggle (HKLM-x32\...\{715AD72D-887A-459E-988B-D4F3E87FA24B}) (Version: 1.04.0.0 - PopCap Games)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Plantronics CSR Driver (64-bit) (Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics CsrDfu Installer (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics HidDfu Installer (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater (HKLM-x32\...\{c76f0fe9-9e26-48ed-a55f-d12fea04cea8}) (Version: 3.1.48496.0 - Plantronics, Inc.)
Plantronics MyHeadset Updater (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Device Handlers (32-bit) (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater DFU Handlers (32-bit) (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Install Check (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater MLS (Version: 3.0.0.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Runtime (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Plantronics MyHeadset Updater Startup (x32 Version: 3.1.48496.0 - Plantronics, Inc.) Hidden
Rename Master (HKLM-x32\...\Rename Master_is1) (Version:  - )
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.4.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.4.0 - Renesas Electronics Corporation) Hidden
roomeon 3D-Planer (HKLM-x32\...\{F33472D8-D8DD-402E-B0CF-110AA3477D4E}) (Version: 1.6.0 - roomeon GmbH)
Sacred 2 Gold (HKLM-x32\...\Steam App 225640) (Version:  - Ascaron)
Samsung Data Migration (HKLM-x32\...\{D4DE3DB4-7734-47E5-8D92-B80146311406}) (Version: 2.6 - Samsung)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Secure Download Manager (HKLM-x32\...\{C58626D6-7EBD-460D-8B6C-75B3C3464879}) (Version: 3.1.60 - Kivuto Solutions Inc.)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
SimCity™ (HKLM-x32\...\{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 4.0.86.0859 - Electronic Arts)
SiSoftware Sandra Lite 2014.SP1a (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 20.21.2014.3 - SiSoftware)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 1.0.2215.10 - Hi-Rez Studios)
Sniper Elite V2 (HKLM-x32\...\Steam App 63380) (Version:  - Rebellion)
Spacebase DF-9 Alpha 4b (HKLM-x32\...\Spacebase DF-9 Alpha 4b) (Version: 4.00 - Unterbilker)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
StarMoney (x32 Version: 4.0.3.24 - StarFinanz) Hidden
StarMoney 9.0  (HKLM-x32\...\{DA3DF6D6-5123-4DD6-98B9-865D79178CEB}) (Version: 9.0 - Star Finanz GmbH)
SteelSeries Engine (HKLM\...\SteelSeries Engine) (Version: 2.8.445.23476 - SteelSeries)
Supraball (HKLM-x32\...\Supraball) (Version:  - Supra Games Gbr)
Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version:  - eTeks)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab for Intel (HKLM-x32\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
TeraCopy 2.3 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector)
The Bureau: XCOM Declassified (HKLM-x32\...\Steam App 65930) (Version:  - 2K Marin)
The Walking Dead 400 Days (HKLM-x32\...\VGhlV2Fsa2luZ0RlYWQ=_is1) (Version: 1 - )
The Walking Dead: Season 2 (HKLM-x32\...\VGhlV2Fsa2luZ0RlYWRTZWFzb24y_is1) (Version: 1 - )
Thief (HKLM-x32\...\VGhpZWY=_is1) (Version: 1 - )
THX-Einrichtungskonsole (HKLM-x32\...\THX_Console_Unicode) (Version:  - )
Tom Clancy's Splinter Cell® Blacklist™ (HKLM-x32\...\{A6356F2F-D3E1-4D83-9AA2-72871DD0C298}) (Version: 1.03 - Ubisoft)
TreeSize Free V2.7 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
Tribes Ascend (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}) (Version: 1.0.1268.1 - Hi-Rez Studios)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Uplay (HKLM-x32\...\Uplay) (Version: 4.3 - Ubisoft)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
WATCH_DOGS (HKLM-x32\...\Uplay Install 274) (Version:  - Ubisoft)
WATCH_DOGS Hotfix (HKLM-x32\...\V0FUQ0hfRE9HUw==_is1) (Version: 1 - )
WildStar (HKLM-x32\...\WildStar) (Version:  - NCSOFT)
Windows-Treiberpaket - Cambridge Silicon Radio (CSRBC) USB  (10/26/2012 2.4.0.0) (HKLM\...\20C7EDA3129B3FF8F72F9BF59252B718B554FBDC) (Version: 10/26/2012 2.4.0.0 - Cambridge Silicon Radio)
WinRAR 5.10 beta 1 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.1 - win.rar GmbH)
WinSCP 5.5.4 (HKLM-x32\...\winscp3_is1) (Version: 5.5.4 - Martin Prikryl)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{47ad9950-5528-4257-bf21-5752c2fd38e9}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2436700119-844545881-3125579626-1006_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

02-08-2014 15:19:19 DirectX wurde installiert
02-08-2014 22:44:51 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
02-08-2014 23:01:03 Windows Modules Installer
03-08-2014 19:06:51 Gerätetreiber-Paketinstallation: Anchorfree Inc Netzwerkdienst
03-08-2014 19:07:56 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
03-08-2014 19:14:28 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
04-08-2014 23:01:44 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-08-02 18:44 - 00450709 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com
127.0.0.1        www.100sexlinks.com
127.0.0.1        100sexlinks.com
127.0.0.1        10sek.com
127.0.0.1        www.10sek.com
127.0.0.1        www.1-2005-search.com
127.0.0.1        1-2005-search.com
127.0.0.1        123fporn.info
127.0.0.1        www.123fporn.info
127.0.0.1        123haustiereundmehr.com
127.0.0.1        www.123haustiereundmehr.com
127.0.0.1        123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {08EED200-6BF1-4207-A7EE-BB2011D6A243} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {112A3638-A79E-4040-9232-F31FCDABF462} - System32\Tasks\Rocket => C:\Program Files (x86)\RocketDock\RocketDock.exe
Task: {22B3AE81-682B-42FA-97CB-9682305DB413} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {3283DF08-BD6A-44DD-BC86-AE5C4C2D7917} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {46B13C52-4B84-47D4-AC05-A9D626B95926} - System32\Tasks\Steam => E:\Spiele\Steam\Steam.exe [2014-07-30] (Valve Corporation)
Task: {513BBE4E-630C-482F-8DA1-83416500822C} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.)
Task: {57D59838-F36B-4E43-92EA-5D0082970E9E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {85EAEF9B-0586-4B3D-A036-4391530AE975} - System32\Tasks\Teamspeak => C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe [2014-07-15] (TeamSpeak Systems GmbH)
Task: {8AB95BE7-F922-4426-852C-E0055AF6E233} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {9190AB9B-52EC-418B-AB02-0402C0A76EBF} - System32\Tasks\lol => S:\League of Legends\lol.launcher.admin.exe [2011-04-26] ()
Task: {A1D60D55-A6B8-401B-BC05-2938E02DF2F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {BC62C5EB-773E-471F-9704-BBC16B2DE8E6} - System32\Tasks\Fraps => C:\Program Files (x86)\Fraps\fraps.exe [2013-02-26] (Beepa P/L)
Task: {CBAB4D57-4E11-4A8C-9804-B74FB10E98F5} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe
Task: {D8BE420E-E4B5-48D9-BF48-3C8F91357C56} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-07-23] (Piriform Ltd)
Task: {F8DC1622-48AE-4BC2-B6AC-2B4A9383DF58} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-08-02 17:16 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-21 12:22 - 2014-05-21 12:22 - 02135232 _____ () C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-07-15 06:44 - 2010-07-15 06:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-03-08 01:52 - 2012-01-20 15:55 - 00678400 _____ () C:\Program Files\TeraCopy\TeraCopyExt64.dll
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2014-07-02 23:54 - 2014-07-02 23:54 - 00866584 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll
2014-07-02 23:59 - 2014-07-02 23:59 - 01050904 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
2014-07-02 23:54 - 2014-07-02 23:54 - 00059160 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll
2014-07-02 23:59 - 2014-07-02 23:59 - 00242456 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
2014-07-08 18:13 - 2014-07-08 18:13 - 00046080 _____ () C:\Users\Thunderhawk\AppData\Local\KeePass\PluginCache\J1dTSUyDMfoJCshbCV5J\Fleck2.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00801792 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SSEngineLib.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00175104 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\DBUtils.dll
2014-05-03 19:19 - 2014-05-03 19:19 - 00089915 ____N () C:\Users\Thunderhawk\AppData\Local\Temp\087a7fb9-4ed6-48f7-81cb-0dfb6f1f0a8b\CliSecureRT64.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00289792 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\DriverCommunication.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00140288 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\ISSPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00148480 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\Localization.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00145408 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\Utilities.dll
2013-01-10 07:46 - 2013-01-10 07:46 - 00047616 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesDrivers\x2api.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 09674752 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SSEngineWinGui.dll
2013-01-10 07:46 - 2013-01-10 07:46 - 01102336 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\System.Data.SQLite.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00209408 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\CustomWPFColorPicker.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00349696 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00171008 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\D3MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00173056 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\KKMousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00171008 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\SRawPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00307200 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\MLGSenseiPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00154624 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\WoWGoldPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00170496 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\GW2MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00169472 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\CSGOMousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00169984 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\DOTA2MousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00157184 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\WoWWirelessPlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00170496 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\CODMousePlugin.dll
2014-04-15 13:02 - 2014-04-15 13:02 - 00169984 _____ () C:\Program Files\SteelSeries\SteelSeries Engine\WoTMousePlugin.dll
2014-03-26 14:45 - 2011-06-21 11:14 - 00207872 _____ () C:\users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-02-02 14:13 - 2007-05-31 09:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2014-06-15 13:18 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-15 13:18 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-15 13:18 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-15 13:18 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-15 13:18 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-08-05 18:56 - 2011-01-13 11:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll
2014-08-05 20:19 - 2014-08-05 20:19 - 00043008 _____ () c:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpopswjk.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\libcef.dll
2014-01-25 23:32 - 2009-03-26 15:46 - 00148480 _____ () C:\Windows\SysWOW64\APOMngr.DLL
2014-01-25 23:32 - 2009-02-06 19:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2014-01-25 20:46 - 2011-08-22 18:57 - 00002560 _____ () C:\Windows\SysWOW64\CTXFIRES.DLL
2014-03-26 16:14 - 2014-05-06 11:24 - 00013824 _____ () C:\Program Files (x86)\Samsung Magician\SAMSUNG_SSD.dll
2014-03-26 16:14 - 2014-05-19 20:20 - 00103424 _____ () C:\Program Files (x86)\Samsung Magician\PAL.dll
2014-03-26 16:14 - 2014-05-19 20:20 - 00039424 _____ () C:\Program Files (x86)\Samsung Magician\SATA.dll
2014-03-26 16:14 - 2014-05-19 20:19 - 00038400 _____ () C:\Program Files (x86)\Samsung Magician\SAT.dll
2014-03-26 16:14 - 2014-05-19 20:20 - 00031232 _____ () C:\Program Files (x86)\Samsung Magician\SMINI.dll
2014-03-26 16:14 - 2014-05-19 20:19 - 00029696 _____ () C:\Program Files (x86)\Samsung Magician\SAS.dll
2014-07-23 12:44 - 2014-07-23 12:44 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/05/2014 08:18:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 06:56:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 06:53:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 01:32:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 00:53:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2014 11:17:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Name des fehlerhaften Moduls: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000975ae
ID des fehlerhaften Prozesses: 0x18ac
Startzeit der fehlerhaften Anwendung: 0xEoCApp.exe0
Pfad der fehlerhaften Anwendung: EoCApp.exe1
Pfad des fehlerhaften Moduls: EoCApp.exe2
Berichtskennung: EoCApp.exe3

Error: (08/04/2014 08:20:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Name des fehlerhaften Moduls: EoCApp.exe, Version: 1.0.81.0, Zeitstempel: 0x53c7a40f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000975ae
ID des fehlerhaften Prozesses: 0x1234
Startzeit der fehlerhaften Anwendung: 0xEoCApp.exe0
Pfad der fehlerhaften Anwendung: EoCApp.exe1
Pfad des fehlerhaften Moduls: EoCApp.exe2
Berichtskennung: EoCApp.exe3

Error: (08/04/2014 06:27:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2014 06:25:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 09:23:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/05/2014 07:41:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "StarMoney 9.0 OnlineUpdate" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/05/2014 06:54:44 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "NPEService" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/05/2014 00:55:40 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.179.2
registriert werden. Der Computer mit IP-Adresse 192.168.179.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (08/05/2014 00:54:00 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "ESET Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/03/2014 09:32:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/03/2014 09:21:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hotspot Shield Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/03/2014 09:20:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎03.‎08.‎2014 um 21:19:34 unerwartet heruntergefahren.

Error: (08/03/2014 09:18:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Hotspot Shield Monitoring Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/03/2014 09:16:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Hotspot Shield Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/03/2014 07:53:53 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}


Microsoft Office Sessions:
=========================
Error: (08/05/2014 08:18:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 06:56:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 06:53:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 01:32:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2014 00:53:06 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2014 11:17:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: EoCApp.exe1.0.81.053c7a40fEoCApp.exe1.0.81.053c7a40fc0000005000975ae18ac01cfb010cbe2fa11E:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exeE:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exeabd286e7-1c1c-11e4-865a-005056c00008

Error: (08/04/2014 08:20:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: EoCApp.exe1.0.81.053c7a40fEoCApp.exe1.0.81.053c7a40fc0000005000975ae123401cfb00416824316E:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exeE:\Divinity\Divinity - Original Sin\Shipping\EoCApp.exefde67c45-1c03-11e4-865a-005056c00008

Error: (08/04/2014 06:27:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2014 06:25:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2014 09:23:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2014-03-09 15:06:56.520
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:56.481
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:56.344
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:56.312
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:45.509
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:45.479
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:45.354
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:45.324
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\THUNDE~1\AppData\Local\Temp\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:39.306
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-09 15:06:39.276
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Thunderhawk\Desktop\PCIUtil.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 48%
Total physical RAM: 6142.17 MB
Available physical RAM: 3139.82 MB
Total Pagefile: 11140.35 MB
Available Pagefile: 7917.85 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windoof) (Fixed) (Total:111.69 GB) (Free:51.36 GB) NTFS
Drive d: (D) (Fixed) (Total:198.74 GB) (Free:61.98 GB) NTFS
Drive e: (Spiele) (Fixed) (Total:1863.01 GB) (Free:589.8 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (Zeug) (Fixed) (Total:931.51 GB) (Free:189.02 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (CDROM) (CDROM) (Total:1.26 GB) (Free:0 GB) CDFS
Drive s: (SpieleSSD) (Fixed) (Total:74.53 GB) (Free:18.06 GB) NTFS
Drive z: (Boxcryptor Classic) (Fixed) (Total:111.69 GB) (Free:51.36 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 32801940)
Partition 1: (Not Active) - (Size=75 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 71CC5308)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 112 GB) (Disk ID: C2F132C6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: ADA9E836)
Partition 1: (Active) - (Size=932 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=932 GB) - (Type=07 NTFS)

========================================================
Disk: 4 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 410721C7)
Partition 1: (Not Active) - (Size=34 GB) - (Type=BC)
Partition 2: (Not Active) - (Size=199 GB) - (Type=OF Extended)

==================== End Of Log ============================
gmer.log:
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-05 20:34:20
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP6T0L0-8 Samsung_SSD_840_EVO_120GB rev.EXT0BB6Q 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\THUNDE~1\AppData\Local\Temp\pxtirfog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1984] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                0000000075838791 4 bytes [C2, 04, 00, 00]
.text  C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1984] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                    0000000075111465 2 bytes [11, 75]
.text  C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1984] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                    00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Windows\system32\Dwm.exe[2132] C:\Windows\system32\d3d11.dll!D3D11CreateDeviceAndSwapChain                                            000007fef7c800f8 9 bytes {MOV RAX, 0x6a144630; JMP RAX}
.text  C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69        0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[2348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155        00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69          0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155          00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2884] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69            0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2884] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155            00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[3160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe[3236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69  0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe[3236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe[4832] C:\Windows\SYSTEM32\ntdll.dll!DbgBreakPoint                  0000000076ea0590 3 bytes [8B, 40, 30]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe[5824] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69              0000000075111465 2 bytes [11, 75]
.text  C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe[5824] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155              00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69              0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[5964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155            00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe[5712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000075111465 2 bytes [11, 75]
.text  C:\users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe[5712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2
.text  C:\Program Files (x86)\Fraps\fraps.exe[5972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                    0000000075111465 2 bytes [11, 75]
.text  C:\Program Files (x86)\Fraps\fraps.exe[5972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    00000000751114bb 2 bytes [11, 75]
.text  ...                                                                                                                                      * 2

---- Threads - GMER 2.1 ----

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6304:6504]                                                                          000007fefb0a2bf8
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6304:6924]                                                                          000007fef2f05124

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch                                                                          2985
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                       
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                      C:\Program Files (x86)\DAEMON Tools Lite\
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                      0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                      0
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                  0xB2 0x2C 0xBF 0xA6 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                               
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                          0x8A 0xB4 0x0A 0x82 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                            0xA0 0x02 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                         
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                    0x33 0x32 0xED 0xBB ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                   
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                          C:\Program Files (x86)\DAEMON Tools Lite\
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                          0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                          0
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                      0xB2 0x2C 0xBF 0xA6 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                           
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                              0x8A 0xB4 0x0A 0x82 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                0xA0 0x02 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                     
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                        0x33 0x32 0xED 0xBB ...

---- EOF - GMER 2.1 ----
MalwareBytes.log:
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 05.08.2014
Suchlauf-Zeit: 19:04:21
Logdatei: MalwareBytes.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.08.05.06
Rootkit Datenbank: v2014.08.04.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Thunderhawk

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 308060
Verstrichene Zeit: 8 Min, 30 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
VirusTotal Scan:
http://s1.directupload.net/images/140805/tgy5banr.jpg

schrauber 06.08.2014 15:24
hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Thunder2001 06.08.2014 22:22
Soo, hier das Log von Combofix. Sorry, dass es so spät kommt, aber bin gerade erst von der Arbeit zurück.

Code:
ComboFix 14-08-06.01 - Thunderhawk 06.08.2014  16:30:28.1.8 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.6142.4130 [GMT 2:00]
ausgeführt von:: c:\users\Thunderhawk\Desktop\ComboFix.exe
AV: ESET Smart Security 7.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personal Firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 7.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\KeePass Password Safe 2\KeePass.exe
c:\users\THUNDE~1\AppData\Local\Temp\087a7fb9-4ed6-48f7-81cb-0dfb6f1f0a8b\CliSecureRT64.dll
c:\users\Thunderhawk\AppData\Local\Temp\087a7fb9-4ed6-48f7-81cb-0dfb6f1f0a8b\CliSecureRT64.dll
c:\users\Thunderhawk\AppData\Roaming\YaTQA
c:\users\Thunderhawk\AppData\Roaming\YaTQA\icons.res
c:\users\Thunderhawk\AppData\Roaming\YaTQA\yatqa.ini
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-07-06 bis 2014-08-06  ))))))))))))))))))))))))))))))
.
.
2014-08-06 14:43 . 2014-08-06 14:43        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-08-05 17:57 . 2014-08-05 18:23        --------        d-----w-        C:\FRST
2014-08-05 17:03 . 2014-08-05 18:36        122584        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 17:02 . 2014-08-05 17:03        --------        d-----w-        c:\program files (x86)\Malwarebytes Anti-Malware
2014-08-05 17:02 . 2014-05-12 05:26        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys
2014-08-05 17:02 . 2014-05-12 05:26        91352        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 16:56 . 2014-08-05 16:56        --------        d-----w-        C:\NPE
2014-08-05 16:54 . 2014-08-05 17:02        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\NPE
2014-08-05 16:54 . 2014-08-05 16:54        --------        d-----w-        c:\programdata\Norton
2014-08-04 22:55 . 2014-08-04 22:55        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\ESET
2014-08-04 22:53 . 2014-08-04 22:53        --------        d-----w-        c:\program files\ESET
2014-08-03 19:39 . 2014-08-03 19:39        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\ElevatedDiagnostics
2014-08-03 17:53 . 2014-08-03 17:53        --------        d-----w-        c:\program files (x86)\Supraball
2014-08-03 16:43 . 2014-08-03 16:43        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\ODUI
2014-08-03 16:41 . 2014-08-03 16:41        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\Stardock
2014-08-03 16:40 . 2014-08-03 16:40        --------        d-----w-        c:\users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 16:39 . 2014-08-03 16:39        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\PackageAware
2014-08-03 11:42 . 2014-08-03 11:42        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\Funcom
2014-08-02 15:18 . 2014-07-25 14:01        1291280        ----a-w-        c:\windows\SysWow64\nvspbridge.dll
2014-08-02 15:18 . 2014-07-25 14:01        1126480        ----a-w-        c:\windows\SysWow64\nvspcap.dll
2014-08-02 15:18 . 2014-07-25 14:01        1715224        ----a-w-        c:\windows\system32\nvspbridge64.dll
2014-08-02 15:18 . 2014-07-25 14:01        1283136        ----a-w-        c:\windows\system32\nvspcap64.dll
2014-08-02 15:18 . 2014-08-02 15:22        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 15:18 . 2014-08-02 15:18        --------        d-----w-        c:\program files (x86)\AGEIA Technologies
2014-08-02 15:16 . 2014-07-02 17:44        609240        ----a-w-        c:\windows\SysWow64\nvStreaming.exe
2014-08-02 15:16 . 2014-08-06 14:26        --------        d-----w-        c:\programdata\NVIDIA
2014-08-02 15:16 . 2014-07-02 18:55        6783776        ----a-w-        c:\windows\system32\nvcpl.dll
2014-08-02 15:16 . 2014-07-02 18:55        3522392        ----a-w-        c:\windows\system32\nvsvc64.dll
2014-08-02 15:16 . 2014-07-02 18:55        935368        ----a-w-        c:\windows\system32\nvvsvc.exe
2014-08-02 15:16 . 2014-07-02 18:55        62808        ----a-w-        c:\windows\system32\nvshext.dll
2014-08-02 15:16 . 2014-07-02 18:55        386520        ----a-w-        c:\windows\system32\nvmctray.dll
2014-08-02 15:16 . 2014-07-02 18:55        2559960        ----a-w-        c:\windows\system32\nvsvcr.dll
2014-08-02 15:16 . 2014-07-02 10:14        3826628        ----a-w-        c:\windows\system32\nvcoproc.bin
2014-08-02 15:16 . 2014-07-02 20:48        75040        ----a-w-        c:\windows\system32\OpenCL.dll
2014-08-02 15:16 . 2014-07-02 20:48        61912        ----a-w-        c:\windows\SysWow64\OpenCL.dll
2014-08-02 13:42 . 2014-08-02 13:42        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 13:42 . 2014-08-02 13:42        --------        d-----w-        c:\users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 13:42 . 2014-08-02 13:42        --------        d-----w-        c:\program files (x86)\TopBanking
2014-07-27 17:32 . 2014-07-27 17:41        --------        d-----w-        c:\program files (x86)\Mozilla Thunderbird
2014-07-26 15:11 . 2014-07-26 15:11        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\Glyph
2014-07-26 15:11 . 2014-07-26 15:11        --------        d-----w-        c:\programdata\Glyph
2014-07-26 12:43 . 2014-07-26 12:43        --------        d-----w-        c:\users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-24 11:07 . 2014-07-24 11:07        --------        d-----w-        c:\programdata\Riot Games
2014-07-21 19:50 . 2014-07-21 19:50        --------        d-----w-        c:\program files (x86)\Common Files\Java
2014-07-21 19:50 . 2014-07-11 01:02        98216        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-19 16:10 . 2014-07-21 20:20        --------        d-----w-        c:\program files (x86)\SpeedFan
2014-07-19 15:00 . 2014-07-19 15:11        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 15:00 . 2014-07-19 15:00        --------        d-----w-        c:\programdata\Bohemia Interactive
2014-07-19 10:34 . 2014-07-19 10:34        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 12:28 . 2014-07-18 12:28        --------        d-----w-        c:\program files (x86)\NirSoft
2014-07-17 10:38 . 2014-07-17 10:38        --------        d-----w-        c:\program files (x86)\Boxcryptor Classic
2014-07-15 15:32 . 2014-07-26 23:28        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-15 15:30 . 2014-07-15 15:30        --------        d-----w-        c:\windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 14:23 . 2014-07-14 14:27        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 14:23 . 2014-07-14 14:23        --------        d-----w-        c:\programdata\Bohemia Interactive Studio
2014-07-14 14:22 . 2014-07-14 14:23        --------        d-----w-        c:\program files (x86)\Common Files\BattlEye
2014-07-14 14:18 . 2014-07-14 14:18        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 14:11 . 2014-07-14 14:11        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 14:10 . 2014-07-14 14:10        --------        d-----w-        c:\program files (x86)\Dotjosh Studios
2014-07-14 13:49 . 2014-07-14 13:49        --------        d-----w-        c:\users\Thunderhawk\AppData\Local\Adobe
2014-07-14 13:26 . 2014-08-03 11:24        --------        d-----w-        c:\users\Thunderhawk\.junique
2014-07-12 22:22 . 2014-06-05 14:45        1460736        ----a-w-        c:\windows\system32\lsasrv.dll
2014-07-12 22:22 . 2014-06-05 14:26        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2014-07-12 22:22 . 2014-06-05 14:25        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-12 22:30 . 2014-01-25 20:54        96441528        ----a-w-        c:\windows\system32\MRT.exe
2014-07-09 13:26 . 2014-01-25 21:42        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-09 13:26 . 2014-01-25 21:42        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-08 18:08 . 2014-05-14 11:08        5659136        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-06-05 15:59 . 2014-04-27 12:16        353280        ----a-w-        c:\windows\system32\ssleay32.dll
2014-06-05 15:59 . 2014-04-27 12:16        353280        ----a-w-        c:\windows\system32\libssl32.dll
2014-06-05 15:59 . 2014-04-27 12:16        1649664        ----a-w-        c:\windows\system32\libeay32.dll
2014-06-05 06:07 . 2014-01-25 21:42        271360        ----a-w-        c:\windows\SysWow64\ssleay32.dll
2014-06-05 06:07 . 2014-01-25 21:42        271360        ----a-w-        c:\windows\SysWow64\libssl32.dll
2014-06-05 06:07 . 2014-01-25 21:42        1177088        ----a-w-        c:\windows\SysWow64\libeay32.dll
2014-05-29 10:43 . 2014-01-25 19:09        57096        ----a-w-        c:\windows\system32\certsentry.dll
2014-05-28 08:30 . 2014-05-28 08:30        283064        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys
2014-05-27 16:44 . 2014-01-31 20:05        386680        ----a-w-        c:\windows\system32\drivers\sptd.sys
2014-05-17 00:42 . 2014-05-17 00:42        42184        ----a-w-        c:\windows\system32\drivers\taphss6.sys
2014-05-12 05:25 . 2014-02-04 19:30        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys
2014-05-09 06:14 . 2014-05-15 09:30        477184        ----a-w-        c:\windows\system32\aepdu.dll
2014-05-09 06:11 . 2014-05-15 09:30        424448        ----a-w-        c:\windows\system32\aeinv.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        131480        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        131480        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        131480        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        131480        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay-cbfs4]
@="{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}"
[HKEY_CLASSES_ROOT\CLSID\{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}]
2013-11-15 13:43        156456        ----a-w-        c:\windows\SysWOW64\cbfsMntNtf4.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BoxcryptorClassic.exe"="c:\program files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe" [2014-07-11 2249472]
"Spotify Web Helper"="c:\users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-04-28 1171000]
"SteelSeries Engine"="c:\program files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe" [2014-04-15 252928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files (x86)\Creative\Volume Panel\VolPanlu.exe" [2010-02-18 241789]
"CTxfiHlp"="CTXFIHLP.EXE" [2011-08-22 25600]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"Plantronics MyHeadset Updater"="c:\program files (x86)\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe" [2014-04-29 79872]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2014-02-06 189480]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
.
c:\users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-7-21 35464216]
Samsung Magician.lnk - c:\windows\system32\schtasks.exe  /run /tn SamsungMagician [2010-11-21 285696]
starteFraps.bat [2012-7-5 112]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2013-12-6 565464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC}"= "c:\windows\SysWOW64\cbfsMntNtf4.dll" [2013-11-15 156456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"EldosMountNotificator-cbfs4"= {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - c:\windows\SysWOW64\cbfsMntNtf4.dll [2013-11-15 156456]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ArcService;Arc Service;c:\program files (x86)\Perfect World Entertainment\Arc\ArcService.exe;c:\program files (x86)\Perfect World Entertainment\Arc\ArcService.exe [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys;c:\windows\SYSNATIVE\DRIVERS\cjusb.sys [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;e:\spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe;e:\spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 iumsvc;Intel(R) Update Manager;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
R3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SteelSeriesDriver;SteelSeries Engine Service;c:\windows\system32\DRIVERS\ssengine.sys;c:\windows\SYSNATIVE\DRIVERS\ssengine.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys;c:\windows\SYSNATIVE\DRIVERS\mv91xx.sys [x]
S1 cbfs4;cbfs4;c:\windows\system32\drivers\cbfs4.sys;c:\windows\SYSNATIVE\drivers\cbfs4.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S2 avmike;AVM FRITZ!Fernzugang IKE Service;c:\program files\FRITZ!Fernzugang\avmike.exe;c:\program files\FRITZ!Fernzugang\avmike.exe [x]
S2 certsrv;AVM FRITZ!Fernzugang Cert Service;c:\program files\FRITZ!Fernzugang\certsrv.exe;c:\program files\FRITZ!Fernzugang\certsrv.exe [x]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\SysWOW64\cjpcsc.exe;c:\windows\SysWOW64\cjpcsc.exe [x]
S2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 nwtsrv;AVM FRITZ!Fernzugang Client;c:\program files\FRITZ!Fernzugang\nwtsrv.exe;c:\program files\FRITZ!Fernzugang\nwtsrv.exe [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
S2 StarMoney 9.0 OnlineUpdate;StarMoney 9.0 OnlineUpdate;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe;c:\program files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S3 busenum;SteelBusSvc;c:\windows\system32\DRIVERS\SteelBus64.sys;c:\windows\SYSNATIVE\DRIVERS\SteelBus64.sys [x]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 NWIM;AVM VPN Miniport;c:\windows\system32\DRIVERS\avmnwim.sys;c:\windows\SYSNATIVE\DRIVERS\avmnwim.sys [x]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
S3 SAlphamHid;SteelHIDSvc;c:\windows\system32\DRIVERS\SAlpham64.sys;c:\windows\SYSNATIVE\DRIVERS\SAlpham64.sys [x]
S3 vpnpbus;EldoS PnP Virtual Bus driver;c:\windows\system32\DRIVERS\vpnpbus.sys;c:\windows\SYSNATIVE\DRIVERS\vpnpbus.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-25 13:26]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        164760        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        164760        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        164760        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04        164760        ----a-w-        c:\users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay-cbfs4]
@="{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}"
[HKEY_CLASSES_ROOT\CLSID\{6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80}]
2013-11-15 13:44        183080        ----a-w-        c:\windows\System32\cbfsMntNtf4.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2014-07-02 10464536]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-07-25 2403104]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-07-25 1283136]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2014-02-24 5581888]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC}"= "c:\windows\system32\cbfsMntNtf4.dll" [2013-11-15 183080]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Alles mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dllink.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://c:\program files (x86)\Free Download Manager\dlfvideo.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: NameServer = 192.168.179.1
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
FF - ProfilePath - c:\users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\
FF - prefs.js: browser.startup.homepage - http://www.trojaner-board.de/157274-...ml#post1340512
FF - prefs.js: keyword.enabled - false
FF - prefs.js: network.proxy.type - 2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-KeePass Password Safe 2 - c:\program files (x86)\KeePass Password Safe 2\KeePass.exe
Wow6432Node-HKCU-Run-RocketDock - c:\program files (x86)\RocketDock\RocketDock.exe
Wow6432Node-HKLM-Run-KeePass 2 PreLoad - c:\program files (x86)\KeePass Password Safe 2\KeePass.exe
Wow6432Node-HKLM-Run-PLTSpokes.exe - c:\program files (x86)\Plantronics\Spokes3G\PLTSpokes.exe
SSODL-EldosMountNotificator-cbfs4    REG_SZ    {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC}- - (no file)
AddRemove-BattlEye for A2 - e:\spiele\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-06  17:06:37
ComboFix-quarantined-files.txt  2014-08-06 15:06
.
Vor Suchlauf: 9 Verzeichnis(se), 56.046.120.960 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 56.662.724.608 Bytes frei
.
- - End Of File - - E4A76062439B2A27AEF23F359D696B20
A36C5E4F47E84449FF07ED3517B43A31

schrauber 07.08.2014 16:55
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

Thunder2001 07.08.2014 17:39
MalwareBytes log:
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 07.08.2014
Suchlauf-Zeit: 18:19:06
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.08.07.07
Rootkit Datenbank: v2014.08.04.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Thunderhawk

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 328550
Verstrichene Zeit: 5 Min, 49 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
AdwCleaner log:
Code:
# AdwCleaner v3.303 - Bericht erstellt am 07/08/2014 um 18:26:46
# Aktualisiert 06/08/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Thunderhawk - THUNDER-PC
# Gestartet von : C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Default\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Thunderhawk\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Thunderhawk\AppData\Roaming\pdfforge

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\anchorfree

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\bq7kyknv.lool\prefs.js ]


[ Datei : C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\prefs.js ]


[ Datei : C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\oca6lwe6.promon\prefs.js ]


*************************

AdwCleaner[R0].txt - [1363 octets] - [07/08/2014 18:26:06]
AdwCleaner[S0].txt - [1231 octets] - [07/08/2014 18:26:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1291 octets] ##########
JRT log:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Thunderhawk on 07.08.2014 at 18:30:04,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\Users\Thunderhawk\AppData\Roaming\mozilla\firefox\profiles\mj10pijt.default\extensions\jid0-oecfxkaph2tc0bn3li9ajrazx6c@jetpack.xpi
Emptied folder: C:\Users\Thunderhawk\AppData\Roaming\mozilla\firefox\profiles\mj10pijt.default\minidumps [2 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.08.2014 at 18:35:32,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST log:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Thunderhawk (administrator) on THUNDER-PC on 07-08-2014 18:36:01
Running from C:\Users\Thunderhawk\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Hi-Rez Studios) E:\Spiele\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Secomba GmbH) C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe
(Spotify Ltd) C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CTxfispi.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe
() C:\Users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10464536 2014-07-02] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [CTxfiHlp] => CTXFIHLP.EXE
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Plantronics MyHeadset Updater] => C:\Program Files (x86)\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe [79872 2014-04-29] (Plantronics)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [BoxcryptorClassic.exe] => C:\Program Files (x86)\Boxcryptor Classic\BoxcryptorClassic.exe [2249472 2014-07-11] (Secomba GmbH)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [Spotify Web Helper] => C:\Users\Thunderhawk\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-29] (Spotify Ltd)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [SteelSeries Engine] => C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe [252928 2014-04-15] (SteelSeries ApS)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starteFraps.bat ()
SSODL: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x020D68C2C09FCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Tcpip\..\Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: [NameServer]192.168.179.1

FireFox:
========
FF ProfilePath: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default
FF Homepage: http://www.trojaner-board.de/157274-...ml#post1340512
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*'))%20%7B%20return%20'PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\idealode.xml
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\youtube.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: CLEO - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\CLEO@guid.customsoftwareconsult.com [2014-07-01]
FF Extension: HTTPS-Everywhere - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\https-everywhere@eff.org [2014-06-28]
FF Extension: Pocket - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\isreaditlater@ideashower.com [2014-07-04]
FF Extension: KeeFox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\keefox@chris.tomlinson [2014-06-11]
FF Extension: NetVideoHunter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\netvideohunter@netvideohunter.com [2014-07-30]
FF Extension: FEBE - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2014-06-11]
FF Extension: Converter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{8B72860F-C5F8-4286-865E-D2C2DB98A9E6} [2014-03-26]
FF Extension: DownloadHelper - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-26]
FF Extension: ImageHost Grabber - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2014-03-26]
FF Extension: about:addons-memory - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\about-addons-memory@tn123.org.xpi [2014-03-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-03-26]
FF Extension: Brief - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\brief@mozdev.org.xpi [2014-03-26]
FF Extension: FurAffinity Extender - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\faextender@neocodenetworks.com.xpi [2014-03-26]
FF Extension: Firebug - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firebug@software.joehewitt.com.xpi [2014-03-26]
FF Extension: Grooveshark Remote - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefox@gsremote.com.xpi [2014-03-26]
FF Extension: Bookmarks Checker - check for bad links - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-03-26]
FF Extension: Furaffinity Download extension for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\fuerholz@gmx.net.xpi [2014-03-26]
FF Extension: Magic Actions for YouTube™ - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi [2014-03-26]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-03-26]
FF Extension: Dict.cc Translation - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\searchdictcc@roughael.xpi [2014-03-26]
FF Extension: ShareMeNot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\sharemenot@franziroesner.com.xpi [2014-03-26]
FF Extension: Smart Referer - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\smart-referer@meh.paranoid.pk.xpi [2014-03-26]
FF Extension: Lyrics Here by Rob W - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\youtube-lyrics-by-rob-w@jetpack.xpi [2014-03-26]
FF Extension: Locator - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff}.xpi [2014-03-26]
FF Extension: FlashGot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-03-26]
FF Extension: Cookie Monster - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2014-03-26]
FF Extension: eBay Sidebar for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2014-03-26]
FF Extension: NoScript - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-26]
FF Extension: Tab Mix Plus - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-03-26]
FF Extension: DownThemAll! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-26]
FF Extension: Greasemonkey - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-03-26]
FF Extension: Adblock Edge - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-05]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-06-26] (Perfect World Entertainment Inc)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-07-14] ()
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [294912 2010-09-30] (Creative Technology Ltd) [File not signed]
S3 DAUpdaterSvc; E:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2011-05-04] (BioWare)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
U2 HiPatchService; E:\Spiele\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2014-06-05] (The OpenVPN Project)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [72344 2008-02-17] (SiSoftware) [File not signed]
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 CSRBC; C:\Windows\System32\Drivers\csrbcx64.sys [38400 2014-04-04] (CSR plc.)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-28] (Disc Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2014-04-09] (Razer Inc)
R3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-27] (Duplex Secure Ltd.)
S3 SteelSeriesDriver; C:\Windows\System32\DRIVERS\ssengine.sys [24064 2013-11-14] () [File not signed]
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 18:36 - 2014-08-07 18:36 - 00027264 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:25 - 2014-08-07 18:26 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-07 18:01 - 2014-08-07 18:17 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 02:00 - 2014-08-07 18:01 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 02:00 - 2014-08-07 18:01 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 16:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-06 16:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-06 16:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-06 16:28 - 2014-08-06 17:08 - 00000000 ____D () C:\Qoobox
2014-08-06 16:28 - 2014-08-06 17:00 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:27 - 2014-08-06 15:26 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-05 20:41 - 2014-08-07 18:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 19:57 - 2014-08-07 18:36 - 00000000 ____D () C:\FRST
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:57 - 2014-08-02 11:06 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-05 19:03 - 2014-08-07 18:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 19:02 - 2014-08-07 18:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-05 19:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 18:54 - 2014-08-05 19:02 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-03 21:20 - 2014-08-07 18:28 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 17:18 - 2014-08-02 17:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-08-02 17:16 - 2014-07-02 20:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-08-02 17:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 17:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-08-02 17:15 - 2014-07-02 23:29 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-02 17:15 - 2014-07-02 23:29 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-02 17:15 - 2014-07-02 23:29 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 17:15 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03196816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00965312 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb
2014-08-02 17:15 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-02 17:15 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-02 17:15 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-02 15:43 - 2014-08-02 16:22 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-07 18:28 - 00003031 _____ () C:\Windows\setupact.log
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-30 20:32 - 2014-07-30 21:04 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-27 19:32 - 2014-07-27 19:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-21 21:50 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-21 21:50 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-21 21:50 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-19 18:10 - 2014-07-21 22:20 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:00 - 2014-07-19 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:32 - 2014-07-27 01:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 19:43 - 2014-07-14 19:44 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:23 - 2014-07-14 16:27 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:18 - 2014-07-14 16:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:26 - 2014-08-03 13:24 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-07-13 00:23 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-13 00:23 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-13 00:23 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-13 00:23 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-13 00:23 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-13 00:23 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-13 00:23 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-13 00:23 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-13 00:23 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-13 00:23 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-13 00:23 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-13 00:23 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-13 00:23 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-13 00:23 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-13 00:23 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-13 00:23 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-13 00:23 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-13 00:23 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-13 00:23 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-13 00:23 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-13 00:23 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-13 00:23 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-13 00:23 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-13 00:23 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-13 00:23 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-13 00:23 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-13 00:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-13 00:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-13 00:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-07 18:36 - 2014-08-07 18:36 - 00027264 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-07 18:36 - 2014-08-05 19:57 - 00000000 ____D () C:\FRST
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\NetSpeedMonitor
2014-08-07 18:35 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-07 18:35 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-07 18:34 - 2011-04-12 09:43 - 00709682 _____ () C:\Windows\system32\perfh007.dat
2014-08-07 18:34 - 2011-04-12 09:43 - 00154012 _____ () C:\Windows\system32\perfc007.dat
2014-08-07 18:34 - 2009-07-14 07:13 - 01648762 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:28 - 2014-08-03 21:20 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-07 18:28 - 2014-08-02 14:04 - 00003031 _____ () C:\Windows\setupact.log
2014-08-07 18:28 - 2014-05-12 01:28 - 00000000 ___RD () C:\Users\Thunderhawk\Dropbox
2014-08-07 18:28 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Dropbox
2014-08-07 18:28 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-07 18:27 - 2014-01-25 21:06 - 01416417 _____ () C:\Windows\WindowsUpdate.log
2014-08-07 18:26 - 2014-08-07 18:25 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:25 - 2014-08-05 20:41 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-07 18:17 - 2014-08-07 18:01 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 18:17 - 2014-08-05 19:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-07 18:17 - 2014-08-05 19:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-07 18:08 - 2014-01-25 23:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-07 18:01 - 2014-08-07 02:00 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 18:01 - 2014-08-07 02:00 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-07 17:57 - 2014-06-15 13:18 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-07 17:57 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Apps\2.0
2014-08-06 23:16 - 2014-01-31 14:43 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-06 23:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-06 17:08 - 2014-08-06 16:28 - 00000000 ____D () C:\Qoobox
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 17:07 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\SKLAVE
2014-08-06 17:00 - 2014-08-06 16:28 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:44 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-06 16:36 - 2014-01-25 23:57 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
2014-08-06 16:27 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\KeePass
2014-08-06 15:26 - 2014-08-06 16:27 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-06 01:15 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\TS3Client
2014-08-05 20:45 - 2014-04-19 19:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Networking Course
2014-08-05 20:23 - 2014-04-26 20:44 - 00003718 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 20:17 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk
2014-08-05 20:01 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\vlc
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:40 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-05 19:40 - 2014-03-23 14:04 - 00000000 ____D () C:\Program Files\WinRAR
2014-08-05 19:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\VMware
2014-08-05 19:34 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\VMware
2014-08-05 19:08 - 2014-03-08 23:24 - 00000000 ____D () C:\TEMP
2014-08-05 19:03 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Malwarebytes
2014-08-05 19:02 - 2014-08-05 18:54 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-04 00:57 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\JDownloader v2.0
2014-08-03 21:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-08-03 20:52 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Free Download Manager
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 17:30 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Deployment
2014-08-03 17:00 - 2014-03-26 14:45 - 00002240 ____H () C:\Users\Thunderhawk\Documents\Default.rdp
2014-08-03 16:48 - 2014-02-23 18:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-03 14:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-03 13:24 - 2014-07-14 15:26 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-08-03 13:24 - 2014-04-06 15:27 - 00000000 ____D () C:\Users\Thunderhawk\.minion
2014-08-03 13:10 - 2014-01-31 13:06 - 00000000 ____D () C:\Program Files\Logitech Gaming Software
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 18:12 - 2014-03-26 16:14 - 00000000 ____D () C:\Program Files (x86)\Samsung Magician
2014-08-02 18:01 - 2014-03-09 16:05 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-02 17:22 - 2014-08-02 17:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:22 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA Corporation
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-01-25 22:39 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 17:18 - 2014-01-25 22:38 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 16:22 - 2014-08-02 15:43 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-02 11:06 - 2014-08-05 19:57 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-01 19:09 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\DAEMON Tools Lite
2014-07-31 15:24 - 2014-02-04 21:13 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-30 21:04 - 2014-07-30 20:32 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-30 19:26 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Thunderbird
2014-07-30 19:18 - 2014-01-25 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-27 19:41 - 2014-07-27 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-27 01:28 - 2014-07-15 17:32 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-26 21:26 - 2014-03-26 14:46 - 00581038 _____ () C:\Users\Thunderhawk\Documents\Thunder.kdbx
2014-07-26 21:25 - 2014-03-26 14:46 - 00000000 ____D () C:\Users\Thunderhawk\Documents\my games
2014-07-26 20:20 - 2014-04-13 14:24 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Roaming\winscp.rnd
2014-07-26 19:40 - 2014-03-26 14:41 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Local\PUTTY.RND
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-26 01:10 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 16:01 - 2014-08-02 17:18 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 22:20 - 2014-07-19 18:10 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-01-25 23:39 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:11 - 2014-07-19 17:00 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 17:01 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-19 12:30 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\.minecraft
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 13:02 - 2014-04-13 14:21 - 00000986 _____ () C:\Users\Public\Desktop\WinSCP.lnk
2014-07-17 13:02 - 2014-04-13 14:21 - 00000000 ____D () C:\Program Files (x86)\WinSCP
2014-07-17 13:01 - 2014-01-25 21:59 - 01677000 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-15 16:10 - 2014-01-31 13:10 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-07-14 19:44 - 2014-07-14 19:43 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:27 - 2014-07-14 16:23 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:23 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArmA 2
2014-07-14 16:22 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:34 - 2014-05-27 20:22 - 00000058 _____ () C:\Users\Thunderhawk\Desktop\Neues Textdokument.txt
2014-07-13 21:02 - 2009-07-14 06:45 - 00394536 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-13 00:33 - 2014-01-25 22:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-13 00:30 - 2014-01-25 22:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-11 03:02 - 2014-07-21 21:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-11 02:56 - 2014-07-21 21:50 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-11 02:56 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-11 02:55 - 2014-07-21 21:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-09 15:39 - 2014-03-23 18:45 - 00000000 ____D () C:\Program Files (x86)\RocketDock
2014-07-09 15:26 - 2014-01-25 23:42 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:26 - 2014-01-25 23:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:26 - 2014-01-25 23:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-08 20:08 - 2014-05-14 13:08 - 05659136 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-07-08 18:06 - 2014-07-08 18:06 - 00001098 _____ () C:\Users\Thunderhawk\Desktop\World of Warcraft - Rising Gods.lnk

Some content of TEMP:
====================
C:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpduxrjt.dll
C:\Users\Thunderhawk\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-07 18:15

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 08.08.2014 16:14

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Thunder2001 09.08.2014 09:45
ESET Online Scanner log:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d143a919dfbd1441b4539b0177fa3285
# engine=19572
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-09 07:15:13
# local_time=2014-08-09 09:15:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 16890087 159198363 0 0
# compatibility_mode_1='ESET Smart Security 7.0'
# compatibility_mode=8221 16777213 100 100 373392 28148255 0 0
# scanned=797374
# found=5
# cleaned=0
# scan_time=22879
# nod_component=V3 Build:0x30000000
sh=B20B0BD8E5CDD280C5DC922FFD896DF50D208CB7 ft=1 fh=59ddf8c2c6946d84 vn="Variante von Win32/HackTool.CheatEngine.AB potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Cheat Engine 6.3\cheatengine-i386.exe"
sh=860EFD5893E4DD4E820227B7DEAD144F974456AC ft=1 fh=c0b9ed8dfe12ffb8 vn="Variante von Win32/HackTool.CheatEngine.AF potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Cheat Engine 6.3\standalonephase1.dat"
sh=EE3CA882FB4443EF06929ECAEAF423B8A55C680B ft=1 fh=724db7b255f14a9a vn="Variante von Win32/BitCoinMiner.BJ potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Dogecoin\dogecoin-qt.exe"
sh=0415AD8BD5F4257B470B879A8C2F6AD6AEDA237F ft=0 fh=0000000000000000 vn="Variante von Android/Remosm.A potenziell unsichere Anwendung" ac=I fn="D:\Handysave\vorCrashHandysave.7z"
sh=B4B36B0EA5BF4F5D689D8632E24E5B67B72D9E89 ft=0 fh=0000000000000000 vn="Win32/PSWTool.KonBoot.A potenziell unsichere Anwendung" ac=I fn="F:\ubcd5(inkl ToolStar).iso"
SecurityCheck log:
Code:
Results of screen317's Security Check version 0.99.86 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
ESET Smart Security 7.0 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Secunia PSI (3.0.0.9016) 
 Java 7 Update 67 
 Java version out of Date!
 Adobe Flash Player 14.0.0.145 
 Adobe Reader XI 
 Mozilla Firefox (31.0)
 Mozilla Thunderbird (31.0.)
````````Process Check: objlist.exe by Laurent```````` 
 ESET NOD32 Antivirus egui.exe 
 ESET NOD32 Antivirus ekrn.exe 
 StarMoney 9.0 ouservice StarMoneyOnlineUpdate.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Thunderhawk (administrator) on THUNDER-PC on 09-08-2014 10:37:39
Running from C:\Users\Thunderhawk\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
() C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Hi-Rez Studios) E:\Spiele\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CTxfispi.exe
() C:\Users\Thunderhawk\Documents\LCDSirReal\LCDSirReal.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Beepa P/L) C:\Program Files (x86)\Fraps\fraps64.dat
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10464536 2014-07-02] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5581888 2014-02-24] (ESET)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [CTxfiHlp] => CTXFIHLP.EXE
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-2436700119-844545881-3125579626-1006\...\Run: [SteelSeries Engine] => C:\Program Files\SteelSeries\SteelSeries Engine\SteelSeriesEngine.exe [252928 2014-04-15] (SteelSeries ApS)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
Startup: C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\starteFraps.bat ()
SSODL: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {17CC3ABF-90ED-4B6D-AF2D-116C7CF789BC} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Thunderhawk\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay-cbfs4 -> {6E2ADCC8-E3A0-4CD2-BE16-01BD69AB8C80} => C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x020D68C2C09FCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: Free Download Manager -> {CC59E0F9-7E43-44FA-9FAA-8377850BF205} -> C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Tcpip\..\Interfaces\{A97AC00F-2870-476B-9163-CCCDC2AA2E83}: [NameServer]192.168.179.1

FireFox:
========
FF ProfilePath: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default
FF Homepage: http://www.trojaner-board.de/157274-...ml#post1340512
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*'))%20%7B%20return%20'PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\idealode.xml
FF SearchPlugin: C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\searchplugins\youtube.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: CLEO - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\CLEO@guid.customsoftwareconsult.com [2014-07-01]
FF Extension: HTTPS-Everywhere - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\https-everywhere@eff.org [2014-06-28]
FF Extension: Pocket - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\isreaditlater@ideashower.com [2014-07-04]
FF Extension: KeeFox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\keefox@chris.tomlinson [2014-06-11]
FF Extension: NetVideoHunter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\netvideohunter@netvideohunter.com [2014-07-30]
FF Extension: FEBE - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2014-06-11]
FF Extension: Converter - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{8B72860F-C5F8-4286-865E-D2C2DB98A9E6} [2014-03-26]
FF Extension: DownloadHelper - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-08-09]
FF Extension: ImageHost Grabber - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8} [2014-03-26]
FF Extension: about:addons-memory - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\about-addons-memory@tn123.org.xpi [2014-03-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-03-26]
FF Extension: Brief - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\brief@mozdev.org.xpi [2014-03-26]
FF Extension: FurAffinity Extender - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\faextender@neocodenetworks.com.xpi [2014-03-26]
FF Extension: Firebug - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firebug@software.joehewitt.com.xpi [2014-03-26]
FF Extension: Grooveshark Remote - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefox@gsremote.com.xpi [2014-03-26]
FF Extension: Bookmarks Checker - check for bad links - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\firefoxbookmarkchecker@everhelper.me.xpi [2014-03-26]
FF Extension: Furaffinity Download extension for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\fuerholz@gmx.net.xpi [2014-03-26]
FF Extension: Magic Actions for YouTube™ - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi [2014-03-26]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-03-26]
FF Extension: Dict.cc Translation - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\searchdictcc@roughael.xpi [2014-03-26]
FF Extension: ShareMeNot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\sharemenot@franziroesner.com.xpi [2014-03-26]
FF Extension: Smart Referer - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\smart-referer@meh.paranoid.pk.xpi [2014-03-26]
FF Extension: Lyrics Here by Rob W - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\youtube-lyrics-by-rob-w@jetpack.xpi [2014-03-26]
FF Extension: Locator - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff}.xpi [2014-03-26]
FF Extension: FlashGot - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2014-03-26]
FF Extension: Cookie Monster - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{45d8ff86-d909-11db-9705-005056c00008}.xpi [2014-03-26]
FF Extension: eBay Sidebar for Firefox - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}.xpi [2014-03-26]
FF Extension: NoScript - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-26]
FF Extension: Tab Mix Plus - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2014-03-26]
FF Extension: DownThemAll! - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-26]
FF Extension: Greasemonkey - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-03-26]
FF Extension: Adblock Edge - C:\Users\Thunderhawk\AppData\Roaming\Mozilla\Firefox\Profiles\mj10pijt.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-26]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-08-05]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-06-26] (Perfect World Entertainment Inc)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [345984 2014-07-14] ()
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [515632 2013-05-21] (REINER SCT)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-01-25] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [294912 2010-09-30] (Creative Technology Ltd) [File not signed]
S3 DAUpdaterSvc; E:\Spiele\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2011-05-04] (BioWare)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2135232 2014-05-21] ()
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1343408 2014-02-24] (ESET)
U2 HiPatchService; E:\Spiele\Hi-Rez Studios\HiPatchService.exe [9216 2014-07-18] (Hi-Rez Studios) [File not signed]
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2014-06-05] (The OpenVPN Project)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.SP1a\RpcAgentSrv.exe [72344 2008-02-17] (SiSoftware) [File not signed]
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [35192 2012-09-04] (REINER SCT)
S3 CSRBC; C:\Windows\System32\Drivers\csrbcx64.sys [38400 2014-04-04] (CSR plc.)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-28] (Disc Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2014-04-09] (Razer Inc)
R3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-05-27] (Duplex Secure Ltd.)
S3 SteelSeriesDriver; C:\Windows\System32\DRIVERS\ssengine.sys [24064 2013-11-14] () [File not signed]
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-09 02:22 - 2014-08-09 02:22 - 00854410 _____ () C:\Users\Thunderhawk\Desktop\SecurityCheck.exe
2014-08-09 02:20 - 2014-08-09 02:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-09 02:19 - 2013-02-08 17:15 - 02347384 _____ (ESET) C:\Users\Thunderhawk\Desktop\esetsmartinstaller_deu.exe
2014-08-08 14:22 - 2014-08-08 14:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\CrashDumps
2014-08-07 23:11 - 2014-08-07 23:11 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-07 18:36 - 2014-08-09 10:37 - 00026309 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:25 - 2014-08-07 18:26 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-07 18:01 - 2014-08-07 18:17 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 02:00 - 2014-08-07 18:01 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 02:00 - 2014-08-07 18:01 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 16:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-06 16:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-06 16:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-06 16:29 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-06 16:28 - 2014-08-06 17:08 - 00000000 ____D () C:\Qoobox
2014-08-06 16:28 - 2014-08-06 17:00 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:27 - 2014-08-06 15:26 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-05 20:41 - 2014-08-09 10:37 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 19:57 - 2014-08-09 10:37 - 00000000 ____D () C:\FRST
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:57 - 2014-08-02 11:06 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-05 19:03 - 2014-08-08 01:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-05 19:02 - 2014-08-07 18:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:02 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-05 19:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 18:54 - 2014-08-05 19:02 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-03 21:20 - 2014-08-07 18:28 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 17:18 - 2014-08-02 17:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-07-25 16:01 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-08-02 17:18 - 2014-07-25 16:01 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 22:48 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-08-02 17:16 - 2014-07-02 20:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-08-02 17:16 - 2014-07-02 20:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-08-02 17:16 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-08-02 17:16 - 2014-07-02 12:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-08-02 17:15 - 2014-07-02 23:29 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-02 17:15 - 2014-07-02 23:29 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-02 17:15 - 2014-07-02 23:29 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-02 17:15 - 2014-07-02 22:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 03196816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00965312 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-08-02 17:15 - 2014-07-02 22:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb
2014-08-02 17:15 - 2014-03-31 18:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-08-02 17:15 - 2014-03-31 18:42 - 00037320 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-08-02 17:15 - 2014-03-31 18:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-08-02 15:43 - 2014-08-02 16:22 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-09 02:18 - 00003703 _____ () C:\Windows\setupact.log
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-30 20:32 - 2014-07-30 21:04 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-27 19:32 - 2014-07-27 19:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-19 18:10 - 2014-07-21 22:20 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:00 - 2014-07-19 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:32 - 2014-07-27 01:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 19:43 - 2014-07-14 19:44 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:23 - 2014-07-14 16:27 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:18 - 2014-07-14 16:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:26 - 2014-08-08 00:58 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-07-13 00:23 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-13 00:23 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-13 00:23 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-13 00:23 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-13 00:23 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-13 00:23 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-13 00:23 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-13 00:23 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-13 00:23 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-13 00:23 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-13 00:23 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-13 00:23 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-13 00:23 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-13 00:23 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-13 00:23 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-13 00:23 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-13 00:23 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-13 00:23 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-13 00:23 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-13 00:23 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-13 00:23 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-13 00:23 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-13 00:23 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-13 00:23 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-13 00:23 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-13 00:23 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-13 00:23 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-13 00:23 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-13 00:23 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-13 00:23 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-13 00:23 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-13 00:23 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-13 00:23 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-13 00:23 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-13 00:23 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-13 00:23 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-13 00:23 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-13 00:23 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-13 00:23 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-13 00:23 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-13 00:23 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-13 00:23 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-13 00:23 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-13 00:22 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-13 00:22 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-13 00:22 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-09 10:38 - 2014-08-07 18:36 - 00026309 _____ () C:\Users\Thunderhawk\Desktop\FRST.txt
2014-08-09 10:37 - 2014-08-05 20:41 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Neuer Ordner
2014-08-09 10:37 - 2014-08-05 19:57 - 00000000 ____D () C:\FRST
2014-08-09 10:37 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\NetSpeedMonitor
2014-08-09 10:08 - 2014-01-25 23:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-09 09:46 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\vlc
2014-08-09 02:25 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-09 02:25 - 2009-07-14 06:45 - 00035232 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-09 02:23 - 2011-04-12 09:43 - 00709682 _____ () C:\Windows\system32\perfh007.dat
2014-08-09 02:23 - 2011-04-12 09:43 - 00154012 _____ () C:\Windows\system32\perfc007.dat
2014-08-09 02:23 - 2009-07-14 07:13 - 01648762 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-09 02:22 - 2014-08-09 02:22 - 00854410 _____ () C:\Users\Thunderhawk\Desktop\SecurityCheck.exe
2014-08-09 02:20 - 2014-08-09 02:20 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-09 02:19 - 2014-01-25 21:06 - 01456070 _____ () C:\Windows\WindowsUpdate.log
2014-08-09 02:18 - 2014-08-02 14:04 - 00003703 _____ () C:\Windows\setupact.log
2014-08-09 02:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-08 14:30 - 2014-05-12 01:28 - 00000000 ___RD () C:\Users\Thunderhawk\Dropbox
2014-08-08 14:22 - 2014-08-08 14:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\CrashDumps
2014-08-08 13:53 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\.minecraft
2014-08-08 13:49 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\TS3Client
2014-08-08 13:43 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Dropbox
2014-08-08 13:43 - 2014-01-31 14:43 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0
2014-08-08 01:42 - 2014-08-05 19:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-08 00:58 - 2014-07-14 15:26 - 00000000 ____D () C:\Users\Thunderhawk\.junique
2014-08-08 00:58 - 2014-04-06 15:27 - 00000000 ____D () C:\Users\Thunderhawk\.minion
2014-08-07 23:11 - 2014-08-07 23:11 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-07 23:11 - 2014-08-07 23:11 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-07 23:10 - 2014-01-31 13:10 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-08-07 18:35 - 2014-08-07 18:35 - 00000933 _____ () C:\Users\Thunderhawk\Desktop\JRT.txt
2014-08-07 18:30 - 2014-08-07 18:30 - 00000000 ____D () C:\Windows\ERUNT
2014-08-07 18:28 - 2014-08-03 21:20 - 00010502 _____ () C:\Windows\PFRO.log
2014-08-07 18:26 - 2014-08-07 18:25 - 00000000 ____D () C:\AdwCleaner
2014-08-07 18:17 - 2014-08-07 18:17 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-07 18:17 - 2014-08-07 18:01 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\trojaner
2014-08-07 18:17 - 2014-08-05 19:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-07 18:01 - 2014-08-07 02:00 - 01475072 _____ () C:\Users\Thunderhawk\Desktop\adwcleaner_3.303.exe
2014-08-07 18:01 - 2014-08-07 02:00 - 01016261 _____ (Thisisu) C:\Users\Thunderhawk\Desktop\JRT.exe
2014-08-07 17:57 - 2014-06-15 13:18 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-07 17:57 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Apps\2.0
2014-08-06 23:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-06 17:08 - 2014-08-06 16:28 - 00000000 ____D () C:\Qoobox
2014-08-06 17:07 - 2014-08-06 17:07 - 00031842 _____ () C:\ComboFix.txt
2014-08-06 17:07 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\SKLAVE
2014-08-06 17:00 - 2014-08-06 16:28 - 00000000 ____D () C:\Windows\erdnt
2014-08-06 16:44 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-06 16:36 - 2014-01-25 23:57 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2
2014-08-06 16:27 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\KeePass
2014-08-06 15:26 - 2014-08-06 16:27 - 05567759 ____R (Swearware) C:\Users\Thunderhawk\Desktop\ComboFix.exe
2014-08-05 20:45 - 2014-04-19 19:25 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Networking Course
2014-08-05 20:23 - 2014-04-26 20:44 - 00003718 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2014-08-05 20:17 - 2014-08-05 20:17 - 00000188 _____ () C:\Users\Thunderhawk\defogger_reenable
2014-08-05 20:17 - 2014-03-26 14:40 - 00000000 ____D () C:\Users\Thunderhawk
2014-08-05 19:57 - 2014-08-05 19:57 - 00380416 _____ () C:\Users\Thunderhawk\Desktop\Gmer-19357.exe
2014-08-05 19:40 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-08-05 19:40 - 2014-03-23 14:04 - 00000000 ____D () C:\Program Files\WinRAR
2014-08-05 19:35 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\VMware
2014-08-05 19:34 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\VMware
2014-08-05 19:08 - 2014-03-08 23:24 - 00000000 ____D () C:\TEMP
2014-08-05 19:03 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Malwarebytes
2014-08-05 19:02 - 2014-08-05 18:54 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NPE
2014-08-05 18:56 - 2014-08-05 18:56 - 00000000 ____D () C:\NPE
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\ESET
2014-08-05 00:55 - 2014-08-05 00:55 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ESET
2014-08-05 00:53 - 2014-08-05 00:53 - 00000000 ____D () C:\Program Files\ESET
2014-08-04 18:49 - 2014-08-04 18:49 - 00001282 _____ () C:\Users\Thunderhawk\Desktop\EoCApp.exe - Verknüpfung.lnk
2014-08-04 00:57 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\JDownloader v2.0
2014-08-03 21:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-08-03 20:52 - 2014-03-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Free Download Manager
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supraball
2014-08-03 19:53 - 2014-08-03 19:53 - 00000000 ____D () C:\Program Files (x86)\Supraball
2014-08-03 18:43 - 2014-08-03 18:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ODUI
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Stardock
2014-08-03 18:41 - 2014-08-03 18:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Stardock
2014-08-03 18:40 - 2014-08-03 18:40 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Stardock
2014-08-03 17:30 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Deployment
2014-08-03 17:00 - 2014-03-26 14:45 - 00002240 ____H () C:\Users\Thunderhawk\Documents\Default.rdp
2014-08-03 16:48 - 2014-02-23 18:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-03 14:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-03 13:42 - 2014-08-03 13:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Funcom
2014-08-03 13:10 - 2014-01-31 13:06 - 00000000 ____D () C:\Program Files\Logitech Gaming Software
2014-08-02 18:30 - 2014-08-02 18:30 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ProcAlyzer Dumps
2014-08-02 18:12 - 2014-08-02 18:12 - 00003254 _____ () C:\Windows\System32\Tasks\SamsungMagician
2014-08-02 18:12 - 2014-03-26 16:14 - 00000000 ____D () C:\Program Files (x86)\Samsung Magician
2014-08-02 18:01 - 2014-03-09 16:05 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-08-02 17:22 - 2014-08-02 17:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA
2014-08-02 17:22 - 2014-03-26 14:41 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\NVIDIA Corporation
2014-08-02 17:18 - 2014-08-02 17:18 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-02 17:18 - 2014-01-25 22:39 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-02 17:18 - 2014-01-25 22:38 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-02 16:22 - 2014-08-02 15:43 - 01594368 _____ () C:\Users\Thunderhawk\Documents\Meine Konten.sub
2014-08-02 15:42 - 2014-08-02 15:42 - 00001992 _____ () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Banking 4W.lnk
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Subsembly
2014-08-02 15:42 - 2014-08-02 15:42 - 00000000 ____D () C:\Program Files (x86)\TopBanking
2014-08-02 14:04 - 2014-08-02 14:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-02 11:06 - 2014-08-05 19:57 - 02094080 _____ (Farbar) C:\Users\Thunderhawk\Desktop\FRST64.exe
2014-08-01 19:09 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\DAEMON Tools Lite
2014-07-31 15:24 - 2014-02-04 21:13 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-30 21:04 - 2014-07-30 20:32 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArcheAge
2014-07-30 19:26 - 2014-03-26 14:42 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Thunderbird
2014-07-30 19:18 - 2014-01-25 23:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-27 19:41 - 2014-07-27 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-07-27 01:28 - 2014-07-15 17:32 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\PAYDAY 2
2014-07-26 21:26 - 2014-03-26 14:46 - 00581038 _____ () C:\Users\Thunderhawk\Documents\Thunder.kdbx
2014-07-26 21:25 - 2014-03-26 14:46 - 00000000 ____D () C:\Users\Thunderhawk\Documents\my games
2014-07-26 20:20 - 2014-04-13 14:24 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Roaming\winscp.rnd
2014-07-26 19:40 - 2014-03-26 14:41 - 00000600 _____ () C:\Users\Thunderhawk\AppData\Local\PUTTY.RND
2014-07-26 17:11 - 2014-07-26 17:11 - 00000609 _____ () C:\Users\Thunderhawk\Desktop\Glyph.lnk
2014-07-26 17:11 - 2014-07-26 17:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Glyph
2014-07-26 14:43 - 2014-07-26 14:43 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\StunlockStudios
2014-07-26 01:10 - 2014-05-12 01:22 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-26 01:09 - 2014-01-25 21:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 16:01 - 2014-08-02 17:18 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-07-25 16:01 - 2014-08-02 17:18 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-07-23 12:44 - 2014-07-23 12:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-21 22:20 - 2014-07-19 18:10 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-07-21 21:50 - 2014-07-21 21:50 - 00004594 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-21 21:50 - 2014-01-25 23:39 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-19 18:10 - 2014-07-19 18:10 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-07-19 18:10 - 2014-07-19 18:10 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-07-19 17:11 - 2014-07-19 17:00 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Arma 3
2014-07-19 17:01 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Arma 3
2014-07-19 12:34 - 2014-07-19 12:34 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Red 5 Studios
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft BlueScreenView
2014-07-18 14:28 - 2014-07-18 14:28 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-07-17 13:02 - 2014-04-13 14:21 - 00000986 _____ () C:\Users\Public\Desktop\WinSCP.lnk
2014-07-17 13:02 - 2014-04-13 14:21 - 00000000 ____D () C:\Program Files (x86)\WinSCP
2014-07-17 13:01 - 2014-01-25 21:59 - 01677000 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-17 12:38 - 2014-07-17 12:38 - 00000000 ____D () C:\Program Files (x86)\Boxcryptor Classic
2014-07-15 17:30 - 2014-07-15 17:30 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2014-07-14 19:44 - 2014-07-14 19:43 - 00000000 ____D () C:\Users\Thunderhawk\Desktop\Boerse
2014-07-14 19:12 - 2014-07-14 19:12 - 00000000 ____D () C:\Users\Thunderhawk\Documents\Larian Studios
2014-07-14 16:27 - 2014-07-14 16:23 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2 OA
2014-07-14 16:23 - 2014-03-26 14:44 - 00000000 ____D () C:\Users\Thunderhawk\Documents\ArmA 2
2014-07-14 16:22 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
2014-07-14 16:18 - 2014-07-14 16:18 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\ArmA 2
2014-07-14 16:11 - 2014-07-14 16:11 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\DayZCommander
2014-07-14 16:10 - 2014-07-14 16:10 - 00000000 ____D () C:\Program Files (x86)\Dotjosh Studios
2014-07-14 15:49 - 2014-07-14 15:49 - 00000000 ____D () C:\Users\Thunderhawk\AppData\Local\Adobe
2014-07-14 15:34 - 2014-05-27 20:22 - 00000058 _____ () C:\Users\Thunderhawk\Desktop\Neues Textdokument.txt
2014-07-13 21:02 - 2009-07-14 06:45 - 00394536 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-13 01:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-13 00:33 - 2014-01-25 22:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-13 00:30 - 2014-01-25 22:54 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Thunderhawk\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4mhpcd.dll
C:\Users\Thunderhawk\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Thunderhawk\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-07 18:15

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 09.08.2014 17:40
Java updaten.

Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Thunder2001 10.08.2014 01:15
Hey.

Super vielen Dank für deine Hilfe und Zeit.
Bin soweit fertig mit der Anleitung und scheint auch alles wieder richtig zu funktionieren.

Wünsche dir noch ein schönes Wochenende.

schrauber 10.08.2014 08:34
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:54 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131