Trojaner-Board - Windows 7: AVAST 3 Funde, Malwarebytes 8 Funde

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7: AVAST 3 Funde, Malwarebytes 8 Funde (https://www.trojaner-board.de/161613-windows-7-avast-3-funde-malwarebytes-8-funde.html)

Windows 7: AVAST 3 Funde, Malwarebytes 8 Funde

Hallo,

ich habe gestern mal wieder einen Komplettscan mit Avast Free Antivirus gemacht.

Mit erschrecken musste ich sehen, wie Avast auch was fand.

Leider weiß ich nicht wo die Log-Datein sind, daher schreibe ich schnell was Avast fand.

1.Bedrohung Win32:Malware-gen -- gelöscht.

2.Bedrohung Java:CVE-2012-1723-BRQ (Expl) -- gelöscht

3.Bedrohung PUP:Win32:Installer-I (PUP) -- gelöscht

4.Bedrohung Win32: DelfMod (Trj) -- gelöscht -- war aber glaube ich ein Fehlalarm.

Danach mit Malwarebytes das System gescannt und auch was gefunden... siehe log.

Anbei schon die logs von FRST und Gmer.

Die Gmer.txt ist leider zu groß also gepackt und als Anhang.

Vielen Dank für eure Hilfe

MfG
rocky012

Malwarebytes:

Code:

<?xml version="1.0" encoding="UTF-16"?>
 

-<mbam-log>
 
 

-<header>
 

<date>2014/12/06 11:41:38 +0100</date>
 

<logfile>mbam-log-2014-12-06 (11-41-37).xml</logfile>
 

<isadmin>no</isadmin>
 

</header>
 
 

-<engine>
 

<version>2.00.4.1028</version>
 

<malware-database>v2014.12.06.05</malware-database>
 

<rootkit-database>v2014.12.03.01</rootkit-database>
 

<license>free</license>
 

<file-protection>disabled</file-protection>
 

<web-protection>disabled</web-protection>
 

<self-protection>disabled</self-protection>
 

</engine>
 
 

-<system>
 

<osversion>Windows 7 Service Pack 1</osversion>
 

<arch>x64</arch>
 

<username>Christoph und Simone</username>
 

<filesys>NTFS</filesys>
 

</system>
 
 

-<summary>
 

<type>threat</type>
 

<result>completed</result>
 

<objects>282260</objects>
 

<time>273</time>
 

<processes>0</processes>
 

<modules>0</modules>
 

<keys>3</keys>
 

<values>0</values>
 

<datas>0</datas>
 

<folders>3</folders>
 

<files>2</files>
 

<sectors>0</sectors>
 

</summary>
 
 

-<options>
 

<memory>enabled</memory>
 

<startup>enabled</startup>
 

<filesystem>enabled</filesystem>
 

<archives>enabled</archives>
 

<rootkits>disabled</rootkits>
 

<deeprootkit>disabled</deeprootkit>
 

<heuristics>enabled</heuristics>
 

<pup>enabled</pup>
 

<pum>enabled</pum>
 

</options>
 
 

-<items>
 
 

-<key>
 

<path>HKLM\SOFTWARE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}</path>
 

<vendor>PUP.Optional.Wajam.A</vendor>
 

<action>delete-on-reboot</action>
 

<hash>009da6b938443105a622dc26f80bd729</hash>
 

</key>
 
 

-<key>
 

<path>HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}</path>
 

<vendor>PUP.Optional.Wajam.A</vendor>
 

<action>delete-on-reboot</action>
 

<hash>009da6b938443105a622dc26f80bd729</hash>
 

</key>
 
 

-<key>
 

<path>HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\jpmbfleldcgkldadpdinhjjopdfpjfjp</path>
 

<vendor>PUP.Optional.Wajam.A</vendor>
 

<action>delete-on-reboot</action>
 

<hash>a7f6afb01864d85e7992641d8f74df21</hash>
 

</key>
 
 

-<folder>
 

<path>C:\Users\Christoph\AppData\Roaming\OpenCandy</path>
 

<vendor>PUP.Optional.OpenCandy</vendor>
 

<action>delete-on-reboot</action>
 

<hash>0f8eb3ac710b171fddd2f421ff04a858</hash>
 

</folder>
 
 

-<folder>
 

<path>C:\Users\Christoph\AppData\Roaming\OpenCandy\2F7AB032A70C434389D5D7E666C22C8D</path>
 

<vendor>PUP.Optional.OpenCandy</vendor>
 

<action>delete-on-reboot</action>
 

<hash>0f8eb3ac710b171fddd2f421ff04a858</hash>
 

</folder>
 
 

-<folder>
 

<path>C:\Users\Christoph\AppData\Roaming\OpenCandy\41C1145BACE144D2BF515F900462EC8F</path>
 

<vendor>PUP.Optional.OpenCandy</vendor>
 

<action>delete-on-reboot</action>
 

<hash>0f8eb3ac710b171fddd2f421ff04a858</hash>
 

</folder>
 
 

-<file>
 

<path>C:\Users\Christoph\AppData\Roaming\OpenCandy\2F7AB032A70C434389D5D7E666C22C8D\PokkiInstaller.exe</path>
 

<vendor>PUP.Optional.OpenCandy</vendor>
 

<action>success</action>
 

<hash>0f8eb3ac710b171fddd2f421ff04a858</hash>
 

</file>
 
 

-<file>
 

<path>C:\Users\Christoph\AppData\Roaming\OpenCandy\41C1145BACE144D2BF515F900462EC8F\PokkiInstaller.exe</path>
 

<vendor>PUP.Optional.OpenCandy</vendor>
 

<action>success</action>
 

<hash>0f8eb3ac710b171fddd2f421ff04a858</hash>
 

</file>
 

</items>
 

</mbam-log>

FRST:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01

Ran by Christoph (administrator) on CHRISTOPH-PC on 07-12-2014 18:04:19

Running from C:\Users\Christoph\Desktop\Trjaner Board

Loaded Profile: Christoph (Available profiles: Christoph & Christoph und Simone)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe

(Mr. John aka japamd) C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe

(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe

(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe

(PacketVideo) C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkyserver.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(AMD) C:\Windows\System32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\USB Sound Blaster HD\Volume Panel\VolPanlu.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)

HKLM\...\Run: [Creative SB Monitoring Utility] => RunDll32 sbavmon.dll,SBAVMonitor

HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe

HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)

HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)

HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\USB Sound Blaster HD\Volume Panel\VolPanlu.exe [241757 2010-12-08] (Creative Technology Ltd)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5226600 2014-11-27] (AVAST Software)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\...\MountPoints2: {ca7c6aed-2076-11e0-a2df-1c6f6591b1f7} - D:\Setupx.exe

HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)

HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2234064 2014-05-06] (Eastman Kodak Company)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x36DF9E187AB4CB01

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Tcpip\..\Interfaces\{E722EEA2-CE9F-4606-B69C-AB173F1DBC4F}: [NameServer] 192.168.2.4
 

FireFox:

========

FF ProfilePath: C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default

FF Homepage: hxxp://www.google.de/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF Extension: Avira SearchFree Toolbar plus WebGuard - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default\Extensions\toolbar@ask.com [2011-06-29]

FF Extension: Adblock Plus - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-29]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-23]

FF Extension: No Name - wrc@avast.com [Not Found]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-27]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-27] (AVAST Software)

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-10-05] (Creative Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [286720 2010-02-12] (Creative Technology Ltd) [File not signed]

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)

S4 MSSQL$MYMOVIES; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)

S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [38200 2014-11-07] (The OpenVPN Project)

S3 Origin Client Service; E:\Spiele\Origin\OriginClientService.exe [1900400 2014-11-28] (Electronic Arts)

R2 RadeonPro Support Service; C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe [20608 2013-11-04] (Mr. John aka japamd) [File not signed]

R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)

R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

R2 TwonkyProxy; C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe [545608 2012-07-09] ()

R2 TwonkyServer; C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe [549704 2012-07-09] (PacketVideo)

R2 TwonkyWebDav; C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe [271176 2012-07-09] ()
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 Alpham1; C:\Windows\System32\DRIVERS\Alpham164.sys [52992 2007-07-23] (Ideazon Corporation)

R3 Alpham2; C:\Windows\System32\DRIVERS\Alpham264.sys [21760 2007-03-20] (Ideazon Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-27] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-27] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-27] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-27] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-27] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-27] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-27] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-27] ()

S3 GigasetGenericUSB_x64; C:\Windows\System32\DRIVERS\GigasetGenericUSB_x64.sys [54272 2013-04-25] (Siemens Home and Office Communication Devices GmbH & Co. KG)

S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1558656 2010-07-14] (Creative Technology Ltd.)

R4 SNAPSHOD0; E:\Temp\SNAPSHOD0.sys [43288 2014-12-07] ()

S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-07 18:04 - 2014-12-07 18:04 - 00000000 ____D () C:\FRST

2014-12-07 18:03 - 2014-12-07 18:04 - 00000000 ____D () C:\Users\Christoph\Desktop\Trjaner Board

2014-12-06 17:42 - 2014-12-06 17:43 - 00000000 ____D () C:\ProgramData\Oracle

2014-12-06 15:02 - 2014-12-06 15:02 - 00001330 _____ () C:\Users\Christoph\Desktop\AIDA64 Extreme.lnk

2014-12-06 14:45 - 2014-12-06 14:45 - 00001330 _____ () C:\Users\Christoph und Simone\Desktop\AIDA64 Extreme.lnk

2014-12-06 13:31 - 2014-12-07 17:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-06 11:39 - 2014-12-06 11:39 - 00001123 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-06 11:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-12-06 11:39 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-12-06 11:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-12-05 20:22 - 2014-12-05 20:22 - 00000979 _____ () C:\Users\Christoph und Simone\Desktop\Origin.lnk

2014-11-29 01:09 - 2014-11-29 01:11 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Heaven Benchmark

2014-11-28 20:12 - 2014-11-28 22:21 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\Origin

2014-11-28 20:09 - 2014-12-05 20:22 - 00000000 ____D () C:\ProgramData\Origin

2014-11-27 22:17 - 2014-11-28 21:23 - 00000000 ____D () C:\ProgramData\Electronic Arts

2014-11-27 22:17 - 2014-11-27 22:17 - 00000000 ____D () C:\ProgramData\EA Core

2014-11-27 00:29 - 2014-11-27 00:29 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-11-27 00:29 - 2014-11-27 00:29 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-11-26 13:02 - 2014-11-26 12:58 - 00356120 _____ (Tom Ehlert Software) C:\Users\Christoph\Desktop\snapshot64.exe

2014-11-25 19:16 - 2014-12-06 14:49 - 00000000 ____D () C:\Program Files (x86)\RivaTuner Statistics Server

2014-11-25 19:16 - 2014-11-25 19:16 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivaTuner Statistics Server

2014-11-21 15:43 - 2014-11-21 15:43 - 00001574 _____ () C:\Users\Christoph und Simone\Desktop\MSIAfterburner.lnk

2014-11-19 15:36 - 2014-11-20 03:41 - 00000219 _____ () C:\Users\Christoph und Simone\Desktop\Wolfenstein The New Order.url

2014-11-19 10:53 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-11-19 10:53 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll

2014-11-19 10:53 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-11-19 10:53 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll

2014-11-18 17:03 - 2014-11-12 21:46 - 00615624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-11-18 17:02 - 2014-11-17 23:18 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-11-18 17:02 - 2014-11-17 23:18 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 31893136 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 24557712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 18514616 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 14032984 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 13944952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 13213512 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-11-18 17:02 - 2014-11-13 01:20 - 11397744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 11336432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 04292416 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 04011208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 02874456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434475.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 01540424 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434475.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00964928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00923792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00900928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00871648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-11-18 15:57 - 2014-11-18 17:13 - 00001042 _____ () C:\Users\Public\Desktop\OpenVPN GUI.lnk

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TAP-Windows

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-11-18 13:00 - 2014-11-18 15:57 - 00000000 ____D () C:\Program Files\OpenVPN

2014-11-17 17:58 - 2014-11-17 18:00 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\Battle.net

2014-11-17 17:57 - 2014-11-25 19:57 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-11-17 17:27 - 2014-11-17 17:27 - 00002177 _____ () C:\Users\Public\Desktop\KODAK AiO Home Center.lnk

2014-11-17 17:23 - 2014-11-17 17:23 - 00000000 ____D () C:\Windows\SysWOW64\spool

2014-11-17 17:22 - 2014-11-17 17:22 - 00000000 ____D () C:\Users\Default\AppData\Roaming\KODAK AiO Home Center2082897210

2014-11-17 17:22 - 2014-11-17 17:22 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\KODAK AiO Home Center2082897210

2014-11-17 17:04 - 2014-11-17 17:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-11-17 17:01 - 2014-11-17 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2014-11-17 17:00 - 2014-11-17 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

2014-11-17 17:00 - 2014-11-17 17:00 - 00000000 ____D () C:\Program Files (x86)\QuickTime

2014-11-17 16:53 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-11-17 16:53 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-11-17 16:53 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-11-17 16:53 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-11-17 16:53 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-11-17 16:53 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-11-17 16:53 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-11-17 16:53 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-11-17 16:53 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-11-17 16:53 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-11-17 16:53 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-11-17 16:53 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-11-17 16:53 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-11-17 16:53 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-11-17 16:53 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-11-17 16:53 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-11-17 16:53 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-11-17 16:53 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-11-17 16:53 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-11-17 16:53 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-11-17 16:53 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-11-17 16:53 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-11-17 16:53 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-11-17 16:53 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-11-17 16:53 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-11-17 16:53 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-11-17 16:53 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-11-17 16:53 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-11-17 16:53 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-11-17 16:53 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-11-17 16:53 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-11-17 16:53 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-11-17 16:53 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-11-17 16:53 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-11-17 16:53 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-11-17 16:53 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-11-17 16:53 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-11-17 16:53 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-11-17 16:53 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-11-17 16:53 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-11-17 16:53 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-11-17 16:53 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-11-17 16:53 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-11-17 16:53 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-11-17 16:53 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-11-17 16:53 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-11-17 16:53 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-11-17 16:53 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-11-17 16:53 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-11-17 16:53 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-11-17 16:53 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-11-17 16:53 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-11-17 16:53 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-11-17 16:53 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-11-17 16:53 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-11-17 16:53 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-11-17 16:53 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-11-17 16:53 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-11-17 16:53 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-11-17 16:53 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-11-17 16:53 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-11-17 16:53 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-11-17 16:53 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2014-11-17 16:53 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2014-11-17 16:53 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-11-17 16:53 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-11-17 16:53 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2014-11-17 16:53 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2014-11-17 16:51 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-11-17 16:51 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-11-17 16:51 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2014-11-17 16:51 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2014-11-17 16:51 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-11-17 16:51 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-11-17 16:51 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-11-17 16:51 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-11-17 16:51 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-11-17 16:51 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-11-17 16:51 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-11-17 16:51 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-11-17 16:51 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL

2014-11-17 16:51 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

2014-11-11 23:14 - 2014-12-07 17:14 - 00012400 _____ () C:\Windows\setupact.log

2014-11-11 23:14 - 2014-11-11 23:14 - 00000000 _____ () C:\Windows\setuperr.log

2014-11-09 20:11 - 2014-11-09 20:14 - 00000000 ____D () C:\Users\Christoph und Simone\Documents\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00001870 _____ () C:\Users\Christoph und Simone\Desktop\OpenRA.lnk

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\Program Files (x86)\OpenRA
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-07 17:56 - 2013-01-06 18:10 - 00000000 ____D () C:\ProgramData\TwonkyServer

2014-12-07 17:22 - 2011-01-15 06:52 - 02069277 _____ () C:\Windows\WindowsUpdate.log

2014-12-07 17:21 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-07 17:21 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-07 17:18 - 2009-07-14 18:58 - 00746770 _____ () C:\Windows\system32\perfh007.dat

2014-12-07 17:18 - 2009-07-14 18:58 - 00167724 _____ () C:\Windows\system32\perfc007.dat

2014-12-07 17:18 - 2009-07-14 06:13 - 01754386 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-07 17:14 - 2014-06-22 14:28 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0

2014-12-07 17:14 - 2013-11-29 08:59 - 00000000 ____D () C:\ProgramData\Kodak

2014-12-07 17:14 - 2011-03-15 18:05 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-12-07 17:14 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-06 17:57 - 2011-02-27 19:55 - 00276860 _____ () C:\Windows\PFRO.log

2014-12-06 17:43 - 2012-03-06 12:35 - 00000000 ____D () C:\Program Files (x86)\Java

2014-12-06 17:43 - 2012-03-06 12:13 - 00000000 ____D () C:\Program Files\Java

2014-12-06 17:42 - 2013-12-03 17:38 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-12-06 17:42 - 2013-09-22 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-12-06 17:13 - 2012-04-27 00:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-06 16:24 - 2011-01-16 13:04 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2014-12-06 15:20 - 2011-09-05 13:00 - 00002452 _____ () C:\Users\Christoph und Simone\Desktop\NVIDIA Inspector Elevated Settings.lnk

2014-12-06 15:06 - 2011-03-23 02:17 - 00001514 _____ () C:\Users\Christoph\Desktop\NVIDIA Inspector Elevated Settings.lnk

2014-12-06 14:49 - 2011-03-15 20:04 - 00000000 ____D () C:\Program Files (x86)\MSI Afterburner

2014-12-06 14:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration

2014-12-06 13:51 - 2012-07-22 17:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-12-05 17:10 - 2011-01-15 06:53 - 00000000 ____D () C:\Users\Christoph

2014-12-03 23:51 - 2012-02-25 17:50 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\KeePass

2014-11-28 21:12 - 2011-01-15 09:16 - 00220050 _____ () C:\Windows\DirectX.log

2014-11-28 20:48 - 2014-04-11 08:30 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Dead Island Ordner

2014-11-28 20:46 - 2014-04-11 08:28 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Mortal Kombat Ordner

2014-11-28 20:44 - 2014-04-11 08:33 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Cryses Ordner

2014-11-28 01:55 - 2014-03-08 07:46 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-11-28 01:55 - 2012-11-18 01:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-11-28 01:55 - 2011-03-15 18:05 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-11-28 01:55 - 2011-03-15 18:04 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-11-27 22:30 - 2011-04-07 13:11 - 00000000 ____D () C:\ProgramData\Solidshield

2014-11-27 10:18 - 2012-02-25 17:39 - 00001126 _____ () C:\Users\Christoph\Desktop\KeePass 2.lnk

2014-11-27 10:18 - 2012-02-25 17:39 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2

2014-11-27 00:29 - 2014-05-09 07:03 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-11-27 00:29 - 2014-02-04 00:07 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-11-27 00:29 - 2013-05-02 15:44 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-11-27 00:29 - 2013-05-02 15:44 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-11-27 00:29 - 2012-02-26 14:04 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-11-26 02:13 - 2012-04-27 00:23 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-11-26 02:13 - 2012-04-27 00:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-11-26 02:13 - 2011-05-22 11:52 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-11-25 19:16 - 2011-03-15 20:04 - 00001107 _____ () C:\Users\Christoph\Desktop\MSI Afterburner.lnk

2014-11-25 19:16 - 2011-01-15 09:02 - 00000000 ____D () C:\Windows\SysWOW64\directx

2014-11-23 17:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2014-11-21 13:28 - 2011-03-23 23:17 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Temp

2014-11-21 13:28 - 2011-03-23 23:17 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Temp

2014-11-21 13:27 - 2014-04-12 00:16 - 00000000 ____D () C:\Users\Christoph und Simone\Documents\RadeonPro Benchmarks

2014-11-21 13:21 - 2011-01-16 21:57 - 00000000 ____D () C:\Windows\Minidump

2014-11-21 13:16 - 2011-01-31 20:22 - 00001192 _____ () C:\Users\Christoph und Simone\Desktop\Windows Explorer.lnk

2014-11-20 05:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-11-18 22:55 - 2014-03-13 14:31 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\dunelegacy

2014-11-18 22:54 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-11-18 13:05 - 2011-02-26 21:11 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Temp

2014-11-18 11:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-11-18 10:44 - 2013-06-29 12:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-11-17 23:18 - 2014-03-08 07:45 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-11-17 17:36 - 2009-07-14 05:45 - 00296864 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-11-17 17:35 - 2014-05-09 12:47 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-11-17 17:28 - 2013-07-16 18:27 - 00000000 ____D () C:\Windows\system32\MRT

2014-11-17 17:27 - 2013-11-29 09:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak

2014-11-17 17:27 - 2011-01-16 13:34 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00800824 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\DPInst.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00800824 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\DPInst.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00106496 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\gacutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00106496 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\gacutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00036352 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\PnPutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00036352 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\PnPutil.exe

2014-11-13 01:20 - 2014-03-08 07:46 - 00074056 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2014-11-13 01:20 - 2014-03-08 07:46 - 00059592 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 20986592 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 19966344 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 16884632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 03262784 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 00989056 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 00027094 _____ () C:\Windows\system32\nvinfo.pb

2014-11-12 22:56 - 2014-03-08 07:46 - 06897352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 03534152 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 02559808 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 00934032 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-11-12 22:56 - 2014-03-08 07:46 - 00386368 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-11-11 11:29 - 2014-03-08 07:46 - 04100776 _____ () C:\Windows\system32\nvcoproc.bin

2014-11-09 21:04 - 2011-01-31 19:39 - 00000000 ____D () C:\Users\Christoph und Simone
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-05 18:16
 

==================== End Of Log ============================

Gmer Addition:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 01

Ran by Christoph at 2014-12-07 18:04:42

Running from C:\Users\Christoph\Desktop\Trjaner Board

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

@BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.10 - GIGABYTE)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)

AIDA64 Extreme Edition v1.50 (HKLM-x32\...\AIDA64 Extreme Edition_is1) (Version: 1.50 - FinalWire Ltd.)

aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden

aioscnnr (x32 Version: 5.8.10.0 - Your Company Name) Hidden

aioscnnr (x32 Version: 7.6.13.10 - Your Company Name) Hidden

AirPort (HKLM-x32\...\{AA68AAAE-41F0-40B5-8896-5947F5FD6889}) (Version: 5.6.1.2 - Apple Inc.)

ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden

Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Ashampoo Burning Studio 2010 Advanced 9.25 (HKLM-x32\...\Ashampoo Burning Studio 2010 Advanced_is1) (Version: 3.1.1 - ashampoo GmbH & Co. KG)

ATI Catalyst Install Manager (HKLM\...\{576A97E3-1A79-6215-49DE-AA358AF47420}) (Version: 3.0.769.0 - ATI Technologies, Inc.)

Avast Free Antivirus (HKLM-x32\...\avast) (Version: 10.0.2208 - AVAST Software)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Bulletstorm (HKLM-x32\...\GFWL_{45410935-3E72-472B-8C35-AB1000008200}) (Version: 1.0.0000.130 - EA)

Bulletstorm (x32 Version: 1.0.0000.130 - EA) Hidden

BulletStorm (x32 Version: 1.0.0001.130 - EA) Hidden

BulletStorm (x32 Version: 1.0.0003.130 - EA) Hidden

BulletStorm (x32 Version: 1.0.0005.130 - EA) Hidden

C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden

center (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden

Creative Systeminformationen (HKLM-x32\...\SysInfo) (Version: 1.10 - Creative Technology Limited)

Crysis Modification - Mster Config v3.01 (HKLM-x32\...\Mster) (Version:  - )

Crysis WARHEAD(R) (HKLM-x32\...\Crysis WARHEAD(R)) (Version:  - Electronic Arts)

Crysis WARHEAD(R) (x32 Version: 1.0 - Crytek) Hidden

Crysis WARHEAD(R) Patch (HKLM-x32\...\Crysis WARHEAD(R) Patch) (Version:  - Electronic Arts)

Crysis WARHEAD(R) Patch (x32 Version: 1.0 - Crytek) Hidden

Crysis(R) (HKLM-x32\...\{000E79B7-E725-4F01-870A-C12942B7F8E4}) (Version: 1.21.0000 - Electronic Arts)

Crysis® 2 (HKLM-x32\...\{6033673D-2530-4587-8AD0-EB059FC263F9}) (Version: 1.0.0.0 - Electronic Arts)

Crysis®3 (HKLM-x32\...\{4198AE83-A3C6-4C41-85C8-EC63E990696E}) (Version: 1.0.0.0 - Electronic Arts)

Data Lifeguard Diagnostic for Windows 1.22 (HKLM-x32\...\{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1) (Version:  - Western Digital Corporation)

Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - )

Dead Island Riptide (HKLM-x32\...\Steam App 216250) (Version:  - Techland)

Dead Space™ 2 (HKLM-x32\...\{96D06FDD-6AF4-4309-BC1B-1C9588B0575E}) (Version: 1.0.941.0 - Electronic Arts)

Diablo III (HKLM-x32\...\Diablo III) (Version: 1.0.8.16603 - Blizzard Entertainment)

Doom 3 (HKLM-x32\...\InstallShield_{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}) (Version: 1.3 - Activision)

Doom 3 (x32 Version: 1.3 - Activision) Hidden

DOOM 3: Resurrection of Evil (HKLM-x32\...\InstallShield_{04347DFD-87B6-4E30-B14D-5DF2888AD8F5}) (Version: 1.0 - Activision)

DOOM 3: Resurrection of Evil (x32 Version: 1.0 - Activision) Hidden

Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)

Duke Nukem Forever (HKLM-x32\...\Steam App 57900) (Version:  - Gearbox Software)

DVD Profiler Version 3.8.2 (HKLM-x32\...\InvelosDVDProfiler_is1) (Version:  - )

Elevated Installer (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden

eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

essentials (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden

Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)

Garmin BaseCamp (HKLM-x32\...\{7C69F731-6471-48FE-899B-1C40F80042C7}) (Version: 4.4.2 - Garmin Ltd or its subsidiaries)

Garmin Express (HKLM-x32\...\{817c6bb8-ea2d-4e12-abbc-e33c3de43f64}) (Version: 3.2.16.0 - Garmin Ltd or its subsidiaries)

Garmin Express (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden

Garmin Express Tray (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden

Garmin POI Loader (HKLM-x32\...\{3213ED5E-7BBE-4613-BE69-8B1E4FE520DD}) (Version: 2.7.3 - Garmin Ltd or its subsidiaries)

Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)

Gigaset QuickSync (HKLM\...\{b49e8cfb-f094-4467-925a-97c23972cb50}) (Version: 8.3.0868.3 - Gigaset Communications GmbH)

Google SketchUp 8 (HKLM-x32\...\{15F02176-0D12-4FAF-B2CD-2767C7781427}) (Version: 3.0.4993 - Google, Inc.)

iCloud (HKLM\...\{2AAF09D5-4B3F-4975-B6A9-ECE2631FC942}) (Version: 4.0.5.20 - Apple Inc.)

iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)

Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

KeePass Password Safe 2.28 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.28 - Dominik Reichl)

Kodak AIO Printer (Version: 7.8.1.0 - Eastman Kodak Company) Hidden

KODAK All-in-One Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.8.5.2 - Eastman Kodak Company)

Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Max Payne 3 (HKLM-x32\...\{1AA94747-3BF6-4237-9E1A-7B3067738FE1}) (Version: 1.0.0.0 - Rockstar Games)

Media Player Codec Pack 4.2.4 (HKLM-x32\...\Media Player - Codec Pack) (Version: 4.2.4 - Media Player Codec Pack)

MediaMonkey 4.0 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.0 - Ventis Media Inc.)

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mortal Kombat Kollection (HKLM-x32\...\Steam App 205350) (Version:  - Other Ocean Interactive)

Mortal Kombat Komplete Edition (HKLM-x32\...\Steam App 237110) (Version:  - NetherRealm Studios)

Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Mozilla Thunderbird 17.0.7 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 17.0.7 (x86 de)) (Version: 17.0.7 - Mozilla)

Mp3tag v2.58 (HKLM-x32\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)

MSI Afterburner 4.0.0 (HKLM-x32\...\Afterburner) (Version: 4.0.0 - MSI Co., LTD)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )

NVIDIA 3D Vision Controller-Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.75 - NVIDIA Corporation)

NVIDIA 3D Vision Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation)

NVIDIA Grafiktreiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)

NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)

ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden

OpenAL (HKLM-x32\...\OpenAL) (Version:  - )

OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)

OpenRA (HKLM-x32\...\OpenRA) (Version:  - OpenRA developers)

OpenVPN 2.3.5-I602  (HKLM\...\OpenVPN) (Version: 2.3.5-I602 - )

Origin (HKLM-x32\...\Origin) (Version: 9.1.10.2728 - Electronic Arts, Inc.)

Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)

Phoenix R/C Demo (HKLM-x32\...\{503DBB1F-E394-46E5-A722-E3D2F6BF4BA6}) (Version: 4.00.10 - Runtime Games Ltd)

PreReq (x32 Version: 6.2.3.0 - Eastman Kodak Company) Hidden

PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)

QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)

RadeonPro 1.0 (Build 1.1.1.0) (HKLM-x32\...\RadeonPro_is1) (Version:  - )

RadioSure (HKU\S-1-5-21-1924797829-3844333793-736860370-1001\...\RadioSure) (Version:  - )

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.32.1111.2010 - Realtek)

Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6121 - Realtek Semiconductor Corp.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.30.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.30.0 - Renesas Electronics Corporation) Hidden

RivaTuner Statistics Server 6.2.0 (HKLM-x32\...\RTSS) (Version: 6.2.0 - Unwinder)

Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.0.9.5 - Rockstar Games)

SmartPack 1.21.0 (HKLM-x32\...\PlexUtil) (Version: 1.21.0 - PLDS)

SonyEditor (remove only) (HKLM-x32\...\SonyEditor) (Version:  - )

StarMoney (x32 Version: 2.0 - StarFinanz) Hidden

StarMoney (x32 Version: 3.0.0.124 - StarFinanz) Hidden

StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden

StarMoney 8.0  (HKLM-x32\...\{DE40B37F-9C52-4646-954B-2D5E7BA2B381}) (Version: 8.0 - Star Finanz GmbH)

StarMoney 9.0  (HKLM-x32\...\{6496E8AE-D68B-462D-B2D3-E4BA1E57D757}) (Version: 9.0 - Star Finanz GmbH)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

TAP-Windows 9.21.1 (HKLM\...\TAP-Windows) (Version: 9.21.1 - )

Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.01 - Ghisler Software GmbH)

Twonky Windows Components (HKLM-x32\...\{7CC673E7-5271-409D-B196-BB76DA60300B}) (Version: 3.0.3 - PacketVideo)

TwonkyManager (HKLM-x32\...\TwonkyManager) (Version: 3.0.3 (58) - PacketVideo)

Unigine Heaven Benchmark v2.0 (HKLM-x32\...\{5E9709F3-B39F-4133-AE60-3EC634971E75}) (Version: 2.0 - Unigine Corp.)

Unigine Heaven DX11 Benchmark 2.5 version 2.5 (HKLM-x32\...\Unigine Heaven DX11 Benchmark 2.5_is1) (Version: 2.5 - )

UP02 Program Upgrade Tool version 1.0 (HKLM\...\{F7267CE3-CF3E-40AD-8A5A-9AFB3FC62178}_is1) (Version: 1.0 - walkera)

USB Sound Blaster HD (HKLM-x32\...\{3BE06146-8ADC-47D7-9AD5-E5CABF1FF90C}) (Version: 1.0 - Creative Technology Limited)

Virtual COM Port Driver (HKLM-x32\...\InstallShield_{9853299F-7AD8-4560-9896-60650BD8ACBF}) (Version: 1.3.1 - STMicroelectronics)

Virtual COM Port Driver (x32 Version: 1.3.1 - STMicroelectronics) Hidden

Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)

Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)

Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)

WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

Wolfenstein: The New Order (HKLM-x32\...\Steam App 201810) (Version:  - Machine Games)

Z Engine (HKLM-x32\...\{2AE2EFF4-A14B-42AB-B364-F04DB651180F}) (Version: 2.5.0.30_DE - Ideazon)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-1924797829-3844333793-736860370-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

CustomCLSID: HKU\S-1-5-21-1924797829-3844333793-736860370-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

CustomCLSID: HKU\S-1-5-21-1924797829-3844333793-736860370-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

CustomCLSID: HKU\S-1-5-21-1924797829-3844333793-736860370-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File
 

==================== Restore Points  =========================
 

05-12-2014 16:04:25 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {2F2F05A4-DDA2-4E08-9C65-06C7EA1BC2E4} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-27] (AVAST Software)

Task: {683425D2-5EC1-4972-A10A-B446A27B9485} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {A3A4A674-1543-4075-A4F0-4A7586428D5A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)

Task: {EC02D6BB-7092-4279-A72D-834CF310F951} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-07-23] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-07-09 19:33 - 2012-07-09 19:33 - 00545608 _____ () C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe

2012-07-09 19:33 - 2012-07-09 19:33 - 00271176 _____ () C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe

2012-07-09 19:36 - 2012-07-09 19:36 - 01672008 _____ () C:\Program Files (x86)\Twonky\TwonkyServer\TwonkyServer.exe

2014-03-08 07:46 - 2014-11-12 22:56 - 00118080 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2013-10-05 22:18 - 2009-12-29 15:52 - 00089088 _____ () C:\Windows\SYSTEM32\CmdRtr64.DLL

2013-10-05 22:18 - 2010-07-14 13:59 - 00237056 _____ () C:\Windows\SYSTEM32\APOMgr64.DLL

2014-12-06 11:09 - 2014-12-06 11:09 - 02905088 _____ () C:\Program Files\AVAST Software\Avast\defs\14120600\algo.dll

2014-12-07 17:14 - 2014-12-07 17:14 - 02905088 _____ () C:\Program Files\AVAST Software\Avast\defs\14120701\algo.dll

2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2013-02-10 18:57 - 2011-01-13 10:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 8.0\ouservice\PATCHW32.dll

2014-07-30 22:39 - 2011-01-13 09:44 - 00232800 _____ () C:\Program Files (x86)\StarMoney 9.0\ouservice\PATCHW32.dll

2012-07-09 19:36 - 2012-07-09 19:36 - 00176968 _____ () C:\Program Files (x86)\Twonky\TwonkyServer\wmdrmdll.dll

2013-10-05 22:18 - 2009-12-29 15:50 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL

2013-10-05 22:18 - 2010-07-14 13:57 - 00182272 _____ () C:\Windows\SysWOW64\APOMngr.DLL

2014-11-27 00:29 - 2014-11-27 00:29 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupreg: EvtMgr6 => C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: Zboard => C:\Program Files (x86)\Ideazon\ZEngine\Zboard.exe
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-1924797829-3844333793-736860370-500 - Administrator - Disabled)

Christoph (S-1-5-21-1924797829-3844333793-736860370-1001 - Administrator - Enabled) => C:\Users\Christoph

Christoph und Simone (S-1-5-21-1924797829-3844333793-736860370-1003 - Limited - Enabled) => C:\Users\Christoph und Simone

Gast (S-1-5-21-1924797829-3844333793-736860370-501 - Limited - Enabled)

HomeGroupUser$ (S-1-5-21-1924797829-3844333793-736860370-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Processor: AMD Phenom(tm) II X4 965 Processor

Percentage of memory in use: 32%

Total physical RAM: 4092.53 MB

Available physical RAM: 2764.56 MB

Total Pagefile: 10234.71 MB

Available Pagefile: 8824.01 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (Windows 7 + Programme) (Fixed) (Total:55.8 GB) (Free:7.19 GB) NTFS

Drive e: (Spiele + Backup + Sonstiges) (Fixed) (Total:465.76 GB) (Free:82.5 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6CF227EB)

Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: A1740DC5)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=55.8 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

hi,

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

hallo,

hier die logs...

AdwCleaner:

Code:

# AdwCleaner v4.104 - Bericht erstellt am 07/12/2014 um 21:01:26

# Aktualisiert 05/12/2014 von Xplode

# Database : 2014-12-03.1 [Live]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Christoph - CHRISTOPH-PC

# Gestartet von : C:\Users\Christoph und Simone\Desktop\Trjaner Board\AdwCleaner_4.104.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default\Extensions\toolbar@ask.com
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\Classes\pokki

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17420
 
 

-\\ Mozilla Firefox v33.1.1 (x86 de)
 

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.InstallDir", "C:\\Program Files (x86)\\Ask.com\\");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.cbid", "JM");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.config-updated", true);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.crumb", "2011.06.29+03.53.01-toolbar010iad-DE-R3JlaWZzd2FsZCxHZXJtYW55");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://de.ask.com/web?q={query}&qsrc={qsrc}&o={o}&l={l}&gct=bar");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.dtid", "YYYYYYYYDE");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.fresh-install", false);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.guid", "d0bd2b90-eda5-4a98-8353-e816e24f5363");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.hxxp-header-whitelist-hosts", "[\"static-dev.en.dev.ask.com\", \"ask.com\", \"www.facebook.com\", \"www.playsushi.com\", \"WWW.google.com\", \"hxxps://websearch.ask.com\", [...]

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.if", "first");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.keyword-toggled-in-session", false);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.l", "dis");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.last-config-req", "1385405321214");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.last-v", "3.12.2.100015");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.locale", "de_DE");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.location", "Greifswald,Germany");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.new-tab-opt-out", true);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.notification-shown", true);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.o", "100000080");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.qsrc", "2871");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.r", "19");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.sa", "NO");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.search-suggestions-enabled", false);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.themeid", "");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.to", "");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.v", "3.12.2.100015");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.asktb.version", "5.12.2.17367");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.enabledAddons", "wrc%40avast.com:10.0.2502.149,toolbar%40ask.com:3.12.2.100015,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:33.1.1");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23,{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3,{CAFEEFAC-0016-0000-0024-[...]

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.toolbar@ask.com.install-event-fired", true);

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");

[bdf1ve0h.default\prefs.js] - Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
 

-\\ Chromium v
 
 

*************************
 

AdwCleaner[R0].txt - [5336 octets] - [07/12/2014 20:57:33]

AdwCleaner[R1].txt - [5396 octets] - [07/12/2014 21:00:09]

AdwCleaner[S0].txt - [5566 octets] - [07/12/2014 21:01:26]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5626 octets] ##########

Junkware:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.0 (11.29.2014:1)

OS: Windows 7 Home Premium x64

Ran by Christoph on 07.12.2014 at 21:08:17,49

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Christoph\AppData\Roaming\mozilla\firefox\profiles\bdf1ve0h.default\minidumps [4 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 07.12.2014 at 21:10:36,93

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

frisches FRST:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01

Ran by Christoph (administrator) on CHRISTOPH-PC on 07-12-2014 21:12:18

Running from C:\Users\Christoph und Simone\Desktop\Trjaner Board

Loaded Profile: Christoph (Available profiles: Christoph & Christoph und Simone)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe

(Mr. John aka japamd) C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe

(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe

(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe

(PacketVideo) C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkyserver.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(AMD) C:\Windows\System32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\USB Sound Blaster HD\Volume Panel\VolPanlu.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)

HKLM\...\Run: [Creative SB Monitoring Utility] => RunDll32 sbavmon.dll,SBAVMonitor

HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe

HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)

HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)

HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\USB Sound Blaster HD\Volume Panel\VolPanlu.exe [241757 2010-12-08] (Creative Technology Ltd)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5226600 2014-11-27] (AVAST Software)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\...\MountPoints2: {ca7c6aed-2076-11e0-a2df-1c6f6591b1f7} - D:\Setupx.exe

HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)

HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2234064 2014-05-06] (Eastman Kodak Company)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x36DF9E187AB4CB01

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Tcpip\..\Interfaces\{E722EEA2-CE9F-4606-B69C-AB173F1DBC4F}: [NameServer] 192.168.2.4
 

FireFox:

========

FF ProfilePath: C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default

FF Homepage: hxxp://www.google.de/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF Extension: Adblock Plus - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-29]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-23]

FF Extension: No Name - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default\extensions\toolbar@ask.com [Not Found]

FF Extension: No Name - wrc@avast.com [Not Found]

FF Extension: No Name - toolbar@ask.com [Not Found]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-27]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-27] (AVAST Software)

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-10-05] (Creative Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [286720 2010-02-12] (Creative Technology Ltd) [File not signed]

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)

S4 MSSQL$MYMOVIES; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)

S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [38200 2014-11-07] (The OpenVPN Project)

S3 Origin Client Service; E:\Spiele\Origin\OriginClientService.exe [1900400 2014-11-28] (Electronic Arts)

R2 RadeonPro Support Service; C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe [20608 2013-11-04] (Mr. John aka japamd) [File not signed]

R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)

R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

R2 TwonkyProxy; C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe [545608 2012-07-09] ()

R2 TwonkyServer; C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe [549704 2012-07-09] (PacketVideo)

R2 TwonkyWebDav; C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe [271176 2012-07-09] ()
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 Alpham1; C:\Windows\System32\DRIVERS\Alpham164.sys [52992 2007-07-23] (Ideazon Corporation)

R3 Alpham2; C:\Windows\System32\DRIVERS\Alpham264.sys [21760 2007-03-20] (Ideazon Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-27] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-27] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-27] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-27] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-27] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-27] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-27] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-27] ()

S3 GigasetGenericUSB_x64; C:\Windows\System32\DRIVERS\GigasetGenericUSB_x64.sys [54272 2013-04-25] (Siemens Home and Office Communication Devices GmbH & Co. KG)

S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1558656 2010-07-14] (Creative Technology Ltd.)

S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-07 21:12 - 2014-12-07 21:12 - 00000000 ____D () C:\FRST

2014-12-07 21:08 - 2014-12-07 21:08 - 00000000 ____D () C:\Windows\ERUNT

2014-12-07 20:57 - 2014-12-07 21:01 - 00000000 ____D () C:\AdwCleaner

2014-12-07 18:03 - 2014-12-07 21:12 - 00000000 ____D () C:\Users\Christoph und Simone\Desktop\Trjaner Board

2014-12-06 17:42 - 2014-12-06 17:43 - 00000000 ____D () C:\ProgramData\Oracle

2014-12-06 15:02 - 2014-12-06 15:02 - 00001330 _____ () C:\Users\Christoph\Desktop\AIDA64 Extreme.lnk

2014-12-06 14:45 - 2014-12-06 14:45 - 00001330 _____ () C:\Users\Christoph und Simone\Desktop\AIDA64 Extreme.lnk

2014-12-06 13:31 - 2014-12-07 17:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-06 11:39 - 2014-12-06 11:39 - 00001123 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-06 11:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-12-06 11:39 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-12-06 11:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-12-05 20:22 - 2014-12-05 20:22 - 00000979 _____ () C:\Users\Christoph und Simone\Desktop\Origin.lnk

2014-11-29 01:09 - 2014-11-29 01:11 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Heaven Benchmark

2014-11-28 20:12 - 2014-11-28 22:21 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\Origin

2014-11-28 20:09 - 2014-12-05 20:22 - 00000000 ____D () C:\ProgramData\Origin

2014-11-27 22:17 - 2014-11-28 21:23 - 00000000 ____D () C:\ProgramData\Electronic Arts

2014-11-27 22:17 - 2014-11-27 22:17 - 00000000 ____D () C:\ProgramData\EA Core

2014-11-27 00:29 - 2014-11-27 00:29 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-11-27 00:29 - 2014-11-27 00:29 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-11-26 13:02 - 2014-11-26 12:58 - 00356120 _____ (Tom Ehlert Software) C:\Users\Christoph\Desktop\snapshot64.exe

2014-11-25 19:16 - 2014-12-06 14:49 - 00000000 ____D () C:\Program Files (x86)\RivaTuner Statistics Server

2014-11-25 19:16 - 2014-11-25 19:16 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivaTuner Statistics Server

2014-11-21 15:43 - 2014-11-21 15:43 - 00001574 _____ () C:\Users\Christoph und Simone\Desktop\MSIAfterburner.lnk

2014-11-19 15:36 - 2014-11-20 03:41 - 00000219 _____ () C:\Users\Christoph und Simone\Desktop\Wolfenstein The New Order.url

2014-11-19 10:53 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-11-19 10:53 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll

2014-11-19 10:53 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-11-19 10:53 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll

2014-11-18 17:03 - 2014-11-12 21:46 - 00615624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-11-18 17:02 - 2014-11-17 23:18 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-11-18 17:02 - 2014-11-17 23:18 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 31893136 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 24557712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 18514616 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 14032984 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 13944952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 13213512 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-11-18 17:02 - 2014-11-13 01:20 - 11397744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 11336432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 04292416 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 04011208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 02874456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434475.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 01540424 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434475.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00964928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00923792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00900928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00871648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-11-18 15:57 - 2014-11-18 17:13 - 00001042 _____ () C:\Users\Public\Desktop\OpenVPN GUI.lnk

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TAP-Windows

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-11-18 13:00 - 2014-11-18 15:57 - 00000000 ____D () C:\Program Files\OpenVPN

2014-11-17 17:58 - 2014-11-17 18:00 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\Battle.net

2014-11-17 17:57 - 2014-11-25 19:57 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-11-17 17:27 - 2014-11-17 17:27 - 00002177 _____ () C:\Users\Public\Desktop\KODAK AiO Home Center.lnk

2014-11-17 17:23 - 2014-11-17 17:23 - 00000000 ____D () C:\Windows\SysWOW64\spool

2014-11-17 17:22 - 2014-11-17 17:22 - 00000000 ____D () C:\Users\Default\AppData\Roaming\KODAK AiO Home Center2082897210

2014-11-17 17:22 - 2014-11-17 17:22 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\KODAK AiO Home Center2082897210

2014-11-17 17:04 - 2014-11-17 17:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-11-17 17:01 - 2014-11-17 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2014-11-17 17:00 - 2014-11-17 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

2014-11-17 17:00 - 2014-11-17 17:00 - 00000000 ____D () C:\Program Files (x86)\QuickTime

2014-11-17 16:53 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-11-17 16:53 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-11-17 16:53 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-11-17 16:53 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-11-17 16:53 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-11-17 16:53 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-11-17 16:53 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-11-17 16:53 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-11-17 16:53 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-11-17 16:53 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-11-17 16:53 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-11-17 16:53 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-11-17 16:53 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-11-17 16:53 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-11-17 16:53 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-11-17 16:53 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-11-17 16:53 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-11-17 16:53 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-11-17 16:53 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-11-17 16:53 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-11-17 16:53 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-11-17 16:53 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-11-17 16:53 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-11-17 16:53 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-11-17 16:53 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-11-17 16:53 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-11-17 16:53 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-11-17 16:53 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-11-17 16:53 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-11-17 16:53 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-11-17 16:53 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-11-17 16:53 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-11-17 16:53 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-11-17 16:53 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-11-17 16:53 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-11-17 16:53 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-11-17 16:53 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-11-17 16:53 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-11-17 16:53 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-11-17 16:53 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-11-17 16:53 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-11-17 16:53 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-11-17 16:53 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-11-17 16:53 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-11-17 16:53 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-11-17 16:53 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-11-17 16:53 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-11-17 16:53 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-11-17 16:53 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-11-17 16:53 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-11-17 16:53 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-11-17 16:53 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-11-17 16:53 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-11-17 16:53 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-11-17 16:53 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-11-17 16:53 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-11-17 16:53 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-11-17 16:53 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-11-17 16:53 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-11-17 16:53 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-11-17 16:53 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-11-17 16:53 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-11-17 16:53 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2014-11-17 16:53 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2014-11-17 16:53 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-11-17 16:53 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-11-17 16:53 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2014-11-17 16:53 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2014-11-17 16:51 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-11-17 16:51 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-11-17 16:51 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2014-11-17 16:51 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2014-11-17 16:51 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-11-17 16:51 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-11-17 16:51 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-11-17 16:51 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-11-17 16:51 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-11-17 16:51 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-11-17 16:51 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-11-17 16:51 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-11-17 16:51 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL

2014-11-17 16:51 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

2014-11-11 23:14 - 2014-12-07 21:02 - 00012456 _____ () C:\Windows\setupact.log

2014-11-11 23:14 - 2014-11-11 23:14 - 00000000 _____ () C:\Windows\setuperr.log

2014-11-09 20:11 - 2014-11-09 20:14 - 00000000 ____D () C:\Users\Christoph und Simone\Documents\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00001870 _____ () C:\Users\Christoph und Simone\Desktop\OpenRA.lnk

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\Program Files (x86)\OpenRA
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-07 21:09 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-07 21:09 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-07 21:07 - 2009-07-14 18:58 - 00746770 _____ () C:\Windows\system32\perfh007.dat

2014-12-07 21:07 - 2009-07-14 18:58 - 00167724 _____ () C:\Windows\system32\perfc007.dat

2014-12-07 21:07 - 2009-07-14 06:13 - 01754386 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-07 21:06 - 2012-07-22 17:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-12-07 21:04 - 2013-01-06 18:10 - 00000000 ____D () C:\ProgramData\TwonkyServer

2014-12-07 21:02 - 2013-11-29 08:59 - 00000000 ____D () C:\ProgramData\Kodak

2014-12-07 21:02 - 2011-03-15 18:05 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-12-07 21:02 - 2011-02-27 19:55 - 00277170 _____ () C:\Windows\PFRO.log

2014-12-07 21:02 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-07 21:01 - 2011-01-15 06:52 - 02076762 _____ () C:\Windows\WindowsUpdate.log

2014-12-07 20:13 - 2012-04-27 00:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-07 17:14 - 2014-06-22 14:28 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0

2014-12-06 17:43 - 2012-03-06 12:35 - 00000000 ____D () C:\Program Files (x86)\Java

2014-12-06 17:43 - 2012-03-06 12:13 - 00000000 ____D () C:\Program Files\Java

2014-12-06 17:42 - 2013-12-03 17:38 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-12-06 17:42 - 2013-09-22 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-12-06 16:24 - 2011-01-16 13:04 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2014-12-06 15:20 - 2011-09-05 13:00 - 00002452 _____ () C:\Users\Christoph und Simone\Desktop\NVIDIA Inspector Elevated Settings.lnk

2014-12-06 15:06 - 2011-03-23 02:17 - 00001514 _____ () C:\Users\Christoph\Desktop\NVIDIA Inspector Elevated Settings.lnk

2014-12-06 14:49 - 2011-03-15 20:04 - 00000000 ____D () C:\Program Files (x86)\MSI Afterburner

2014-12-06 14:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration

2014-12-05 17:10 - 2011-01-15 06:53 - 00000000 ____D () C:\Users\Christoph

2014-12-03 23:51 - 2012-02-25 17:50 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\KeePass

2014-11-28 21:12 - 2011-01-15 09:16 - 00220050 _____ () C:\Windows\DirectX.log

2014-11-28 20:48 - 2014-04-11 08:30 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Dead Island Ordner

2014-11-28 20:46 - 2014-04-11 08:28 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Mortal Kombat Ordner

2014-11-28 20:44 - 2014-04-11 08:33 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Cryses Ordner

2014-11-28 01:55 - 2014-03-08 07:46 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-11-28 01:55 - 2012-11-18 01:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-11-28 01:55 - 2011-03-15 18:05 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-11-28 01:55 - 2011-03-15 18:04 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-11-27 22:30 - 2011-04-07 13:11 - 00000000 ____D () C:\ProgramData\Solidshield

2014-11-27 10:18 - 2012-02-25 17:39 - 00001126 _____ () C:\Users\Christoph\Desktop\KeePass 2.lnk

2014-11-27 10:18 - 2012-02-25 17:39 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2

2014-11-27 00:29 - 2014-05-09 07:03 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-11-27 00:29 - 2014-02-04 00:07 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-11-27 00:29 - 2013-05-02 15:44 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-11-27 00:29 - 2013-05-02 15:44 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-11-27 00:29 - 2012-02-26 14:04 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-11-26 02:13 - 2012-04-27 00:23 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-11-26 02:13 - 2012-04-27 00:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-11-26 02:13 - 2011-05-22 11:52 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-11-25 19:16 - 2011-03-15 20:04 - 00001107 _____ () C:\Users\Christoph\Desktop\MSI Afterburner.lnk

2014-11-25 19:16 - 2011-01-15 09:02 - 00000000 ____D () C:\Windows\SysWOW64\directx

2014-11-23 17:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2014-11-21 13:28 - 2011-03-23 23:17 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Temp

2014-11-21 13:28 - 2011-03-23 23:17 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Temp

2014-11-21 13:27 - 2014-04-12 00:16 - 00000000 ____D () C:\Users\Christoph und Simone\Documents\RadeonPro Benchmarks

2014-11-21 13:21 - 2011-01-16 21:57 - 00000000 ____D () C:\Windows\Minidump

2014-11-21 13:16 - 2011-01-31 20:22 - 00001192 _____ () C:\Users\Christoph und Simone\Desktop\Windows Explorer.lnk

2014-11-20 05:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-11-18 22:55 - 2014-03-13 14:31 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\dunelegacy

2014-11-18 22:54 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-11-18 13:05 - 2011-02-26 21:11 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Temp

2014-11-18 11:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-11-18 10:44 - 2013-06-29 12:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-11-17 23:18 - 2014-03-08 07:45 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-11-17 17:36 - 2009-07-14 05:45 - 00296864 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-11-17 17:35 - 2014-05-09 12:47 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-11-17 17:28 - 2013-07-16 18:27 - 00000000 ____D () C:\Windows\system32\MRT

2014-11-17 17:27 - 2013-11-29 09:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak

2014-11-17 17:27 - 2011-01-16 13:34 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00800824 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\DPInst.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00800824 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\DPInst.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00106496 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\gacutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00106496 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\gacutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00036352 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\PnPutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00036352 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\PnPutil.exe

2014-11-13 01:20 - 2014-03-08 07:46 - 00074056 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2014-11-13 01:20 - 2014-03-08 07:46 - 00059592 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 20986592 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 19966344 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 16884632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 03262784 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 00989056 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 00027094 _____ () C:\Windows\system32\nvinfo.pb

2014-11-12 22:56 - 2014-03-08 07:46 - 06897352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 03534152 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 02559808 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 00934032 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-11-12 22:56 - 2014-03-08 07:46 - 00386368 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-11-11 11:29 - 2014-03-08 07:46 - 04100776 _____ () C:\Windows\system32\nvcoproc.bin

2014-11-09 21:04 - 2011-01-31 19:39 - 00000000 ____D () C:\Users\Christoph und Simone
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-05 18:16
 

==================== End Of Log ============================

--- --- ---

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

hi,

hier die neuen logs...

ESET - hat noch 2 Sache gefunden!?

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=a2e5dd1e34afd54ca6d1f4a72a877988

# engine=21464

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-12-09 08:51:55

# local_time=2014-12-09 09:51:55 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='avast! Internet Security'

# compatibility_mode=779 16777213 85 72 1038171 182539205 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 44462 169744965 0 0

# scanned=262987

# found=2

# cleaned=0

# scan_time=11771

sh=1736C47063E8E95902CA01F287D24C76AFFDDED8 ft=1 fh=0182462c0b921376 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="E:\Treiber + Programme\Programme\ashampoo_burning_studio_2010_advanced_9.24_7590.exe"

sh=2E40D7FEEE5439F62C4FF97ABA5509E86C6F2A3E ft=1 fh=bb1f3b8f5fdf3ec2 vn="Variante von Win32/InstallCore.D evtl. unerwünschte Anwendung" ac=I fn="E:\Treiber + Programme\Programme\RadioSure-2_2_1036-setup_exe.exe"

checkup

Code:

 Results of screen317's Security Check version 0.99.91  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

avast! Antivirus   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Java 8 Update 25  

 Java version 32-bit out of Date! 

 Adobe Flash Player 15.0.0.239  

 Adobe Reader XI  

 Mozilla Firefox (33.1.1) 

 Mozilla Thunderbird (17.0.7) 
 ````````Process Check: objlist.exe by Laurent````````  

 StarMoney 8.0 ouservice StarMoneyOnlineUpdate.exe  

 StarMoney 9.0 ouservice StarMoneyOnlineUpdate.exe  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast AvastUI.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

aktelle FRST

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01

Ran by Christoph (administrator) on CHRISTOPH-PC on 09-12-2014 12:48:40

Running from C:\Users\Christoph und Simone\Desktop\Trjaner Board

Loaded Profile: Christoph (Available profiles: Christoph & Christoph und Simone)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe

(Mr. John aka japamd) C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe

(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe

(Star Finanz-Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe

(PacketVideo) C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files (x86)\Twonky\TwonkyServer\twonkyserver.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(AMD) C:\Windows\System32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\USB Sound Blaster HD\Volume Panel\VolPanlu.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)

HKLM\...\Run: [Creative SB Monitoring Utility] => RunDll32 sbavmon.dll,SBAVMonitor

HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe

HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)

HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)

HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\USB Sound Blaster HD\Volume Panel\VolPanlu.exe [241757 2010-12-08] (Creative Technology Ltd)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5226600 2014-11-27] (AVAST Software)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\...\MountPoints2: {ca7c6aed-2076-11e0-a2df-1c6f6591b1f7} - D:\Setupx.exe

HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)

HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2234064 2014-05-06] (Eastman Kodak Company)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Christoph und Simone\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll No File

ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x36DF9E187AB4CB01

HKU\S-1-5-21-1924797829-3844333793-736860370-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Tcpip\..\Interfaces\{E722EEA2-CE9F-4606-B69C-AB173F1DBC4F}: [NameServer] 192.168.2.4
 

FireFox:

========

FF ProfilePath: C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default

FF Homepage: hxxp://www.google.de/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF Extension: Adblock Plus - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-29]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-23]

FF Extension: No Name - C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\bdf1ve0h.default\extensions\toolbar@ask.com [Not Found]

FF Extension: No Name - wrc@avast.com [Not Found]

FF Extension: No Name - toolbar@ask.com [Not Found]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-27]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-27] (AVAST Software)

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-10-05] (Creative Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [286720 2010-02-12] (Creative Technology Ltd) [File not signed]

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)

S4 MSSQL$MYMOVIES; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)

S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [38200 2014-11-07] (The OpenVPN Project)

S3 Origin Client Service; E:\Spiele\Origin\OriginClientService.exe [1900400 2014-11-28] (Electronic Arts)

R2 RadeonPro Support Service; C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe [20608 2013-11-04] (Mr. John aka japamd) [File not signed]

R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)

R2 StarMoney 9.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)

R2 TwonkyProxy; C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe [545608 2012-07-09] ()

R2 TwonkyServer; C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe [549704 2012-07-09] (PacketVideo)

R2 TwonkyWebDav; C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe [271176 2012-07-09] ()
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 Alpham1; C:\Windows\System32\DRIVERS\Alpham164.sys [52992 2007-07-23] (Ideazon Corporation)

R3 Alpham2; C:\Windows\System32\DRIVERS\Alpham264.sys [21760 2007-03-20] (Ideazon Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-27] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-27] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-27] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-27] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-27] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-27] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-27] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-27] ()

S3 GigasetGenericUSB_x64; C:\Windows\System32\DRIVERS\GigasetGenericUSB_x64.sys [54272 2013-04-25] (Siemens Home and Office Communication Devices GmbH & Co. KG)

S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1558656 2010-07-14] (Creative Technology Ltd.)

S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-09 12:48 - 2014-12-09 12:48 - 00000000 ____D () C:\FRST

2014-12-08 20:05 - 2014-12-08 20:05 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-12-07 21:08 - 2014-12-07 21:08 - 00000000 ____D () C:\Windows\ERUNT

2014-12-07 18:03 - 2014-12-09 12:48 - 00000000 ____D () C:\Users\Christoph und Simone\Desktop\Trjaner Board

2014-12-06 17:42 - 2014-12-06 17:43 - 00000000 ____D () C:\ProgramData\Oracle

2014-12-06 15:02 - 2014-12-06 15:02 - 00001330 _____ () C:\Users\Christoph\Desktop\AIDA64 Extreme.lnk

2014-12-06 14:45 - 2014-12-06 14:45 - 00001330 _____ () C:\Users\Christoph und Simone\Desktop\AIDA64 Extreme.lnk

2014-12-06 13:31 - 2014-12-07 17:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-12-06 11:39 - 2014-12-06 11:39 - 00001123 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-12-06 11:39 - 2014-12-06 11:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-12-06 11:39 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-12-06 11:39 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-12-06 11:39 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-12-05 20:22 - 2014-12-05 20:22 - 00000979 _____ () C:\Users\Christoph und Simone\Desktop\Origin.lnk

2014-11-29 01:09 - 2014-11-29 01:11 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Heaven Benchmark

2014-11-28 20:12 - 2014-11-28 22:21 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\Origin

2014-11-28 20:09 - 2014-12-05 20:22 - 00000000 ____D () C:\ProgramData\Origin

2014-11-27 22:17 - 2014-11-28 21:23 - 00000000 ____D () C:\ProgramData\Electronic Arts

2014-11-27 22:17 - 2014-11-27 22:17 - 00000000 ____D () C:\ProgramData\EA Core

2014-11-27 00:29 - 2014-11-27 00:29 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-11-27 00:29 - 2014-11-27 00:29 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-11-26 13:02 - 2014-11-26 12:58 - 00356120 _____ (Tom Ehlert Software) C:\Users\Christoph\Desktop\snapshot64.exe

2014-11-25 19:16 - 2014-12-06 14:49 - 00000000 ____D () C:\Program Files (x86)\RivaTuner Statistics Server

2014-11-25 19:16 - 2014-11-25 19:16 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivaTuner Statistics Server

2014-11-21 15:43 - 2014-11-21 15:43 - 00001574 _____ () C:\Users\Christoph und Simone\Desktop\MSIAfterburner.lnk

2014-11-19 15:36 - 2014-11-20 03:41 - 00000219 _____ () C:\Users\Christoph und Simone\Desktop\Wolfenstein The New Order.url

2014-11-19 10:53 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-11-19 10:53 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll

2014-11-19 10:53 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-11-19 10:53 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll

2014-11-18 17:03 - 2014-11-12 21:46 - 00615624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-11-18 17:02 - 2014-11-17 23:18 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-11-18 17:02 - 2014-11-17 23:18 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 31893136 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 24557712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 18514616 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 14032984 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 13944952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 13213512 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-11-18 17:02 - 2014-11-13 01:20 - 11397744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 11336432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 04292416 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 04011208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 02874456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434475.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 01540424 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434475.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00964928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00923792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00900928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00871648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-11-18 17:02 - 2014-11-13 01:20 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-11-18 15:57 - 2014-11-18 17:13 - 00001042 _____ () C:\Users\Public\Desktop\OpenVPN GUI.lnk

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TAP-Windows

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN

2014-11-18 15:57 - 2014-11-18 15:57 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-11-18 13:00 - 2014-11-18 15:57 - 00000000 ____D () C:\Program Files\OpenVPN

2014-11-17 17:58 - 2014-11-17 18:00 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\Battle.net

2014-11-17 17:57 - 2014-11-25 19:57 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-11-17 17:27 - 2014-11-17 17:27 - 00002177 _____ () C:\Users\Public\Desktop\KODAK AiO Home Center.lnk

2014-11-17 17:23 - 2014-11-17 17:23 - 00000000 ____D () C:\Windows\SysWOW64\spool

2014-11-17 17:22 - 2014-11-17 17:22 - 00000000 ____D () C:\Users\Default\AppData\Roaming\KODAK AiO Home Center2082897210

2014-11-17 17:22 - 2014-11-17 17:22 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\KODAK AiO Home Center2082897210

2014-11-17 17:04 - 2014-11-17 17:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-11-17 17:01 - 2014-11-17 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2014-11-17 17:00 - 2014-11-17 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

2014-11-17 17:00 - 2014-11-17 17:00 - 00000000 ____D () C:\Program Files (x86)\QuickTime

2014-11-17 16:53 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-11-17 16:53 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-11-17 16:53 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-11-17 16:53 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-11-17 16:53 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-11-17 16:53 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-11-17 16:53 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-11-17 16:53 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-11-17 16:53 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-11-17 16:53 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-11-17 16:53 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-11-17 16:53 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-11-17 16:53 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-11-17 16:53 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-11-17 16:53 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-11-17 16:53 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-11-17 16:53 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-11-17 16:53 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-11-17 16:53 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-11-17 16:53 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-11-17 16:53 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-11-17 16:53 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-11-17 16:53 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-11-17 16:53 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-11-17 16:53 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-11-17 16:53 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-11-17 16:53 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-11-17 16:53 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-11-17 16:53 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-11-17 16:53 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-11-17 16:53 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-11-17 16:53 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-11-17 16:53 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-11-17 16:53 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-11-17 16:53 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-11-17 16:53 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-11-17 16:53 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-11-17 16:53 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-11-17 16:53 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-11-17 16:53 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-11-17 16:53 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-11-17 16:53 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-11-17 16:53 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-11-17 16:53 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-11-17 16:53 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-11-17 16:53 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-11-17 16:53 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-11-17 16:53 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-11-17 16:53 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-11-17 16:53 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-11-17 16:53 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-11-17 16:53 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-11-17 16:53 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-11-17 16:53 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-11-17 16:53 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-11-17 16:53 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-11-17 16:53 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-11-17 16:53 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-11-17 16:53 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-11-17 16:53 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-11-17 16:53 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-11-17 16:53 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-11-17 16:53 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2014-11-17 16:53 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2014-11-17 16:53 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-11-17 16:53 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-11-17 16:53 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2014-11-17 16:53 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2014-11-17 16:51 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-11-17 16:51 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-11-17 16:51 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2014-11-17 16:51 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2014-11-17 16:51 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-11-17 16:51 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-11-17 16:51 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-11-17 16:51 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2014-11-17 16:51 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2014-11-17 16:51 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-11-17 16:51 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-11-17 16:51 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-11-17 16:51 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-11-17 16:51 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-11-17 16:51 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-11-17 16:51 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-11-17 16:51 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL

2014-11-17 16:51 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

2014-11-11 23:14 - 2014-12-09 06:32 - 00012624 _____ () C:\Windows\setupact.log

2014-11-11 23:14 - 2014-11-11 23:14 - 00000000 _____ () C:\Windows\setuperr.log

2014-11-09 20:11 - 2014-11-09 20:14 - 00000000 ____D () C:\Users\Christoph und Simone\Documents\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00001870 _____ () C:\Users\Christoph und Simone\Desktop\OpenRA.lnk

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenRA

2014-11-09 19:23 - 2014-11-09 19:23 - 00000000 ____D () C:\Program Files (x86)\OpenRA
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-09 12:13 - 2012-04-27 00:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-09 12:06 - 2013-01-06 18:10 - 00000000 ____D () C:\ProgramData\TwonkyServer

2014-12-09 06:39 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-09 06:39 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-09 06:38 - 2009-07-14 18:58 - 00746770 _____ () C:\Windows\system32\perfh007.dat

2014-12-09 06:38 - 2009-07-14 18:58 - 00167724 _____ () C:\Windows\system32\perfc007.dat

2014-12-09 06:38 - 2009-07-14 06:13 - 01754386 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-09 06:35 - 2011-01-15 06:52 - 01052117 _____ () C:\Windows\WindowsUpdate.log

2014-12-09 06:32 - 2013-11-29 08:59 - 00000000 ____D () C:\ProgramData\Kodak

2014-12-09 06:32 - 2011-03-15 18:05 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-12-09 06:32 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-08 20:05 - 2012-07-22 17:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-12-07 21:02 - 2011-02-27 19:55 - 00277170 _____ () C:\Windows\PFRO.log

2014-12-07 17:14 - 2014-06-22 14:28 - 00000000 ____D () C:\Program Files (x86)\StarMoney 9.0

2014-12-06 17:43 - 2012-03-06 12:35 - 00000000 ____D () C:\Program Files (x86)\Java

2014-12-06 17:43 - 2012-03-06 12:13 - 00000000 ____D () C:\Program Files\Java

2014-12-06 17:42 - 2013-12-03 17:38 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-12-06 17:42 - 2013-12-03 17:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-12-06 17:42 - 2013-09-22 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-12-06 16:24 - 2011-01-16 13:04 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2014-12-06 15:20 - 2011-09-05 13:00 - 00002452 _____ () C:\Users\Christoph und Simone\Desktop\NVIDIA Inspector Elevated Settings.lnk

2014-12-06 15:06 - 2011-03-23 02:17 - 00001514 _____ () C:\Users\Christoph\Desktop\NVIDIA Inspector Elevated Settings.lnk

2014-12-06 14:49 - 2011-03-15 20:04 - 00000000 ____D () C:\Program Files (x86)\MSI Afterburner

2014-12-06 14:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration

2014-12-05 17:10 - 2011-01-15 06:53 - 00000000 ____D () C:\Users\Christoph

2014-12-03 23:51 - 2012-02-25 17:50 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\KeePass

2014-11-28 21:12 - 2011-01-15 09:16 - 00220050 _____ () C:\Windows\DirectX.log

2014-11-28 20:48 - 2014-04-11 08:30 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Dead Island Ordner

2014-11-28 20:46 - 2014-04-11 08:28 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Mortal Kombat Ordner

2014-11-28 20:44 - 2014-04-11 08:33 - 00000000 ___RD () C:\Users\Christoph und Simone\Desktop\Cryses Ordner

2014-11-28 01:55 - 2014-03-08 07:46 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation

2014-11-28 01:55 - 2012-11-18 01:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-11-28 01:55 - 2011-03-15 18:05 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-11-28 01:55 - 2011-03-15 18:04 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-11-27 22:30 - 2011-04-07 13:11 - 00000000 ____D () C:\ProgramData\Solidshield

2014-11-27 10:18 - 2012-02-25 17:39 - 00001126 _____ () C:\Users\Christoph\Desktop\KeePass 2.lnk

2014-11-27 10:18 - 2012-02-25 17:39 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe 2

2014-11-27 00:29 - 2014-05-09 07:03 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-11-27 00:29 - 2014-02-04 00:07 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-11-27 00:29 - 2013-05-02 15:44 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-11-27 00:29 - 2013-05-02 15:44 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-11-27 00:29 - 2012-02-26 14:04 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-11-27 00:29 - 2012-01-23 11:29 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-11-26 02:13 - 2012-04-27 00:23 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-11-26 02:13 - 2012-04-27 00:23 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-11-26 02:13 - 2011-05-22 11:52 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-11-25 19:16 - 2011-03-15 20:04 - 00001107 _____ () C:\Users\Christoph\Desktop\MSI Afterburner.lnk

2014-11-25 19:16 - 2011-01-15 09:02 - 00000000 ____D () C:\Windows\SysWOW64\directx

2014-11-23 17:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2014-11-21 13:28 - 2011-03-23 23:17 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Temp

2014-11-21 13:28 - 2011-03-23 23:17 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Temp

2014-11-21 13:27 - 2014-04-12 00:16 - 00000000 ____D () C:\Users\Christoph und Simone\Documents\RadeonPro Benchmarks

2014-11-21 13:21 - 2011-01-16 21:57 - 00000000 ____D () C:\Windows\Minidump

2014-11-21 13:16 - 2011-01-31 20:22 - 00001192 _____ () C:\Users\Christoph und Simone\Desktop\Windows Explorer.lnk

2014-11-20 05:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-11-18 22:55 - 2014-03-13 14:31 - 00000000 ____D () C:\Users\Christoph und Simone\AppData\Roaming\dunelegacy

2014-11-18 22:54 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-11-18 13:05 - 2011-02-26 21:11 - 00000000 ____D () C:\Users\Christoph\AppData\Roaming\Temp

2014-11-18 11:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-11-18 10:44 - 2013-06-29 12:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-11-17 23:18 - 2014-03-08 07:45 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-11-17 17:36 - 2009-07-14 05:45 - 00296864 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-11-17 17:35 - 2014-05-09 12:47 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-11-17 17:28 - 2013-07-16 18:27 - 00000000 ____D () C:\Windows\system32\MRT

2014-11-17 17:27 - 2013-11-29 09:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak

2014-11-17 17:27 - 2011-01-16 13:34 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00800824 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\DPInst.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00800824 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\DPInst.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00106496 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\gacutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00106496 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\gacutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00036352 _____ (Microsoft Corporation) C:\Users\Default\AppData\Roaming\PnPutil.exe

2014-11-17 17:22 - 2013-03-03 11:58 - 00036352 _____ (Microsoft Corporation) C:\Users\Default User\AppData\Roaming\PnPutil.exe

2014-11-13 01:20 - 2014-03-08 07:46 - 00074056 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2014-11-13 01:20 - 2014-03-08 07:46 - 00059592 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 20986592 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 19966344 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 16884632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 03262784 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 00989056 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-11-13 01:20 - 2014-03-08 07:45 - 00027094 _____ () C:\Windows\system32\nvinfo.pb

2014-11-12 22:56 - 2014-03-08 07:46 - 06897352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 03534152 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 02559808 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 00934032 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2014-11-12 22:56 - 2014-03-08 07:46 - 00386368 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2014-11-12 22:56 - 2014-03-08 07:46 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2014-11-11 11:29 - 2014-03-08 07:46 - 04100776 _____ () C:\Windows\system32\nvcoproc.bin

2014-11-09 21:04 - 2011-01-31 19:39 - 00000000 ____D () C:\Users\Christoph und Simone
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-05 18:16
 

==================== End Of Log ============================

--- --- ---

--- --- ---

MfG
rocky012

Die Funde kannste ignorieren.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

hi,

ersmal vielen Dank für Deine große Hilfe.

Leider habe ich gerade ein Problem mit AVAST bekommen.

Er sagt mir jetzt schon zum zweiten mal:

INFEKTION BLOKIERT
URL: hxxp://54.148.105.203/rest/micro/container?name=myTwonky
Infektion: URL:Mal
Prozess: C:\Program Files (x86)\Twonky\TwonkyServer\TwonkyServer.exe

Hatte ich vorher noch nie

Was könnte das sein? - Fehlalarm?

MfG
rocky012

Du nutzt den TwonkyServer ja mit Absicht oder? Ich denke an einen Fehlalarm.

hi,

ja nutze ihn mit Absicht, dann ist es wohl ein Fehlalarm.

Ein Problem habe ich jetzt noch.

Windows Defender lässt sich nicht mehr starten.

Es kommt der Fehler:
Der Dienst Windows Defender auf lokaler Computer konnte nicht gestartet werden.
Fehler 0x800706f7: Das Stub erhielt falsche Daten.

AVAST habe ich auch schon mal deaktiviert - leider keine Abhilfe.

Ich weiß nicht ob das hierher gehört aber vielleicht weißt Du ja auch hier drauf eine Antwort.

Vielen Dank nochmal

MfG
rocky012

hi,

Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

hi,

hier der log

FSS:

Code:

Farbar Service Scanner Version: 21-07-2014

Ran by Christoph (administrator) on 11-12-2014 at 13:15:34

Running from "C:\Users\Christoph und Simone\Desktop\Trjaner Board"

Microsoft Windows 7 Home Premium  Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************
 

Internet Services:

============
 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.
 
 

Windows Firewall:

=============
 

Firewall Disabled Policy: 

==================
 
 

System Restore:

============
 

System Restore Disabled Policy: 

========================
 
 

Action Center:

============
 
 

Windows Update:

============
 

Windows Autoupdate Disabled Policy: 

============================
 
 

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

The start type of WinDefend service is OK.

The ImagePath of WinDefend service is OK.

The ServiceDll of WinDefend service is OK.
 
 

Other Services:

==============
 
 

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys

[2014-07-13 16:19] - [2014-05-30 07:45] - 0497152 ____A (Microsoft Corporation) FA886682CFC5D36718D3E436AACF10B9
 

C:\Windows\System32\drivers\tdx.sys

[2014-12-09 19:47] - [2014-11-11 02:46] - 0119296 ____A (Microsoft Corporation) 70988118145F5F10EF24720B97F35F65
 

C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => File is digitally signed

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll

[2014-12-09 19:48] - [2014-07-07 03:06] - 0187904 ____A (Microsoft Corporation) 19D511CC455C19DE1ADF60E6C39C85B6
 

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\System32\ipnathlp.dll => MD5 is legit

C:\Windows\System32\iphlpsvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit
 
 

**** End of log ****

MfG
rocky012

http://www.deeprybka.trojaner-board....r/wraioneu.PNG

Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

http://deeprybka.trojaner-board.de/b...srepair271.png

hi,

Windows Defender geht wieder.

Nach einem Sicherheitsupdate von Windows + Neustart ist wieder alles i.O.

Keine Ahnung was da los war.

Trotzdem vielen Dank für deine Mühe und vielen Dank für meinen viren- und malwarefreien PC.

MfG
rocky012