Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Popups, neue unerwünschte Seiten beim Browsen ..WIN7 Ultimate (https://www.trojaner-board.de/149992-popups-neue-unerwuenschte-seiten-beim-browsen-win7-ultimate.html)

hardyxy9 19.02.2014 17:30
Popups, neue unerwünschte Seiten beim Browsen ..WIN7 Ultimate
 
Hallo,

mich nerven in Google Chrome Browser auf meinem WIN7 Desktoprechner (Chrome auf Laptop alles gut) seit einiger Zeit Popups und neue Tabs von Seiten wie zB

hxxp://s.m2pub.com/ ...

oder zB

hxxp://rewardzone.exclusivezrewardcenter.com/?sov=63634301&hid=dljprhdrflfpfpft&nodl=nodl&id=XNSX.gewinne

wenn ich auf einen beliebigen Link klicke. Wenn ich dann die unerwünschten Seiten / Popups wegklicke komme ich beimzweiten Mal meist dorthin, wo ich eigentlich hinwollte.

Was mache ich jetzt, was ist denn das?

Danke für Eure Hilfe,

cosinus 19.02.2014 23:32
Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

hardyxy9 20.02.2014 07:51
Hallo cosinus,
danke dass du dich der Sache annimmst!
Generelle Frage: Soll bzw. kann ich mich beim Abarbeiten der ToDo Liste als Admin eingeloggt haben?

Hier die 2 Logs. Es gibt sonst keine weiteren Logs, die ich posten könnte. (Malwarebytes -welches ich installiert habe und das den lfd.Betrieb überwacht- schlägt manchmal an und blockiert das weitersurfen, teils sehr restriktiv, wie ich finde ..)



FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2014
Ran by H1234 (administrator) on H1234-HP on 20-02-2014 07:40:41
Running from C:\Users\H1234\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Brother\bratimer.exe
(Sanford, L.P.) C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) C:\Windows\system32\PrintCtrl.exe
(ActMask Co.,Ltd - hxxp://www.all2pdf.com) C:\Windows\system32\PrintDisp.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\beats64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(ActMask Co.,Ltd - hxxp://www.all2pdf.com) C:\Windows\System32\PrintDisp.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
() C:\Program Files (x86)\Philips ToUcam Camera\GameCam SE\Program\RFTray.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(RealNetworks, Inc.) C:\Program Files (x86)\real\realplayer\Update\realsched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
() C:\Program Files (x86)\XSManager\WTGService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2010-10-22] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-10] (IDT, Inc.)
HKLM\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415752 2009-08-13] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2093064 2009-08-13] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4195848 2009-08-13] (Logitech Inc.)
HKLM\...\Run: [PrintDisp] - C:\Windows\system32\PrintDisp.exe [828416 2011-08-08] (ActMask Co.,Ltd - hxxp://www.all2pdf.com)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [PE2CKFNT SE] - C:\Program Files (x86)\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe [25088 1998-07-03] ()
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1163264 2011-04-01] ()
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4962320 2014-01-22] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] - C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-28] (Easybits)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\real\realplayer\update\realsched.exe [295072 2013-01-19] (RealNetworks, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHQE.EXE [283232 2012-11-05] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1095000 2013-12-13] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Run: [TrafficTravisv4] - C:\Users\H1234\AppData\Roaming\Traffic Travis v4\TrafficTravisV4.exe [21954560 2014-02-13] ()
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\TS_KeyLodaded\...\Run: [DymoQuickPrint] - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe [1825360 2011-01-28] (Sanford, L.P.)
HKU\TS_KeyLodaded\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\TS_KeyLodaded\...\Run: [WebCamRT.exe] - C:\Program Files (x86)\Philips ToUcam Camera\SpotLife\WebCamRT.exe /WinStart /regkey=Software\Spotlife\Spotlife.5\WebCamSettings
HKU\TS_KeyLodaded\...\Run: [TrafficTravisv4] - C:\Users\H1234\AppData\Roaming\Traffic Travis v4\TrafficTravisV4.exe
HKU\TS_KeyLodaded\...\Policies\system: [DisableLockWorkstation] 0
HKU\TS_KeyLodaded\...\Policies\system: [DisableChangePassword] 0
HKU\TS_KeyLodaded\...\Policies\system: [LogonHoursAction] 2
HKU\TS_KeyLodaded\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\H1234 Surf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\H1234\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\Jessi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicyUsers\S-1-5-21-2928652112-3187983571-3213460233-1003\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=10&cc=&mi=2ededfe8000000000000386077677cb6
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {136E043D-39D8-4884-88F7-B47A3B070908} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - URL hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - TopResultURLFallback hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - TopResultURL hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6D86E8C4-91E9-4665-A437-FC2456DA195B} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=2ededfe8000000000000386077677cb6&r=219
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: IEHlprObj Class - {DA5A2A9E-DF07-4a8e-B423-BC5CD4D1880C} - C:\Program Files\WebBoomerang\IEHelper.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-11-24] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default
FF user.js: detected! => C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\user.js
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @dymo.com/DymoLabelFramework - C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll ( Sanford L.P.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\searchplugins\ChatZumSearch.xml
FF SearchPlugin: C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\searchplugins\utorrentbarde-customized-web-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Bazaar Friend - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\addon@bazaarfriend.com [2013-08-12]
FF Extension: Real Summer Sale - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\realsummersale1@realsummersale.com [2013-09-18]
FF Extension: Garmin Communicator - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-12-10]
FF Extension: Bargain Workbench - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{8eaa2500-4118-4c33-9927-988702ba63bd} [2013-09-18]
FF Extension: Snap.Do  - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{d14aaada-f47b-4e88-80ec-62198918d1e8} [2013-06-29]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-02-20]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-16]
FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-01-19]

Chrome:
=======
CHR HomePage: hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=48&cc=&mi=2ededfe8000000000000386077677cb6
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (DYMO Label Framework) - C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll ( Sanford L.P.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll No File
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Extension: (TubeSaver-15) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\aacaalipcbmakfddcbikkebnjedofmec [2013-11-13]
CHR Extension: (Google Docs) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-20]
CHR Extension: (Google Drive) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-20]
CHR Extension: (YouTube) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-20]
CHR Extension: (Google-Suche) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-20]
CHR Extension: (RealDownloader) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-05-20]
CHR Extension: (Iminent) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl [2013-10-21]
CHR Extension: (DealPly Germany) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf [2013-10-21]
CHR Extension: (Google Wallet) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-12]
CHR Extension: (Google Mail) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-20]
CHR HKLM-x32\...\Chrome\Extension: [aaaaaakfopmidbfddimafofbdngbkidf] - C:\Users\H1234\AppData\Local\APN\GoogleCRXs\aaaaaakfopmidbfddimafofbdngbkidf_7.13.0.0.crx [2013-05-20]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM-x32\...\Chrome\Extension: [jpgfhihjicjofdejkbjgnjlaglaciobe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-06-03]

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3788816 2014-01-22] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 BRA_Scheduler; C:\Program Files (x86)\Brother\bratimer.exe [98304 2012-12-11] ()
S2 CLKMSVC10_38F51D56; c:\Program Files (x86)\Cyberlink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-02-25] (CyberLink)
S3 DATEV Update-Service; J:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe [155232 2011-02-21] (DATEV eG)
R2 DymoPnpService; C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe [32336 2011-01-28] (Sanford, L.P.)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [250712 2013-12-13] (Garmin Ltd or its subsidiaries)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [327392 2012-01-14] ()

==================== Drivers (Whitelisted) ====================

S3 ampa; C:\Windows\system32\ampa.sys [15288 2011-12-26] ()
S3 ampa; C:\Windows\SysWOW64\ampa.sys [12728 2011-12-26] ()
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 cmntnet; C:\Windows\System32\DRIVERS\cmntnet.sys [141824 2013-02-13] (Wireless Data Device)
S3 cmnuusbser; C:\Windows\System32\DRIVERS\cmnuusbser.sys [123904 2013-02-13] (Wireless Device)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-11-24] ()
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U0 dmboot;
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S2 VBoxDRV; \??\O:\VirtualBox\Portable-VirtualBox\app64\drivers\VBoxDrv\VBoxDrv.sys [X]
S2 VBoxUSBMon; \??\O:\VirtualBox\Portable-VirtualBox\app64\drivers\USB\filter\VBoxUSBMon.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-20 07:40 - 2014-02-20 07:41 - 00034306 _____ () C:\Users\H1234\Downloads\FRST.txt
2014-02-20 07:40 - 2014-02-20 07:40 - 00000000 ____D () C:\FRST
2014-02-20 07:39 - 2014-02-20 07:39 - 02153472 _____ (Farbar) C:\Users\H1234\Downloads\FRST64.exe
2014-02-18 21:57 - 2014-02-18 21:57 - 00000887 _____ () C:\Users\Public\Desktop\osu!.lnk
2014-02-18 12:03 - 2014-02-18 12:03 - 01241888 _____ () C:\Users\H1234 Surf\Downloads\adwcleaner_3.0.1.9.exe
2014-02-16 21:35 - 2014-02-16 21:35 - 00023912 _____ () C:\Users\H1234\Desktop\Plue_eating_candy.jpeg
2014-02-16 21:33 - 2014-02-16 21:33 - 00016050 _____ () C:\Users\H1234\Downloads\imgres.htm
2014-02-16 21:17 - 2014-02-16 21:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-16 20:22 - 2014-02-19 22:38 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-02-16 19:54 - 2014-02-16 20:11 - 56952904 _____ (ppy Pty. Ltd.) C:\Users\Jessi\Downloads\osu!install.exe
2014-02-12 17:00 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 17:00 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 17:00 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 17:00 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 17:00 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 17:00 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 17:00 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 17:00 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 17:00 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 17:00 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 17:00 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 17:00 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 17:00 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 17:00 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 17:00 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 17:00 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 17:00 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 17:00 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 17:00 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 17:00 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 17:00 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 17:00 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 17:00 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 17:00 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 17:00 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 17:00 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 17:00 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 17:00 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 17:00 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 17:00 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 17:00 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 17:00 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 17:00 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 17:00 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 17:00 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 17:00 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 17:00 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 17:00 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 17:00 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 17:00 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 17:00 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 15:13 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 15:13 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 15:13 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 15:13 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 15:13 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 15:13 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 15:12 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 15:12 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 15:12 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 15:12 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 15:12 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 15:12 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 15:12 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 15:12 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 15:12 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 15:12 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 15:12 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 15:12 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 15:12 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 15:12 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 15:12 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 15:12 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 15:12 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 15:12 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 14:04 - 2014-02-12 14:05 - 00002287 _____ () C:\Users\Public\Desktop\SteuerSparErklärung Selbstständige 2014.lnk
2014-02-12 14:04 - 2014-02-12 14:04 - 00000000 ____D () C:\Users\H1234\AppData\Local\AAV
2014-02-08 13:53 - 2014-02-08 13:53 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Local\Howler
2014-01-24 17:05 - 2014-01-24 17:05 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2014-02-20 07:41 - 2014-02-20 07:40 - 00034306 _____ () C:\Users\H1234\Downloads\FRST.txt
2014-02-20 07:40 - 2014-02-20 07:40 - 00000000 ____D () C:\FRST
2014-02-20 07:40 - 2012-05-03 11:39 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-20 07:39 - 2014-02-20 07:39 - 02153472 _____ (Farbar) C:\Users\H1234\Downloads\FRST64.exe
2014-02-20 07:39 - 2012-04-25 00:01 - 02042042 _____ () C:\Windows\WindowsUpdate.log
2014-02-20 07:38 - 2012-10-29 17:33 - 00003994 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4660930C-7526-42E5-9C1F-E778262B9B60}
2014-02-20 07:35 - 2012-05-03 11:39 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-20 07:34 - 2011-11-24 04:16 - 00000000 ____D () C:\ProgramData\truesuite
2014-02-20 07:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-20 07:34 - 2009-07-14 05:51 - 00019456 _____ () C:\Windows\setupact.log
2014-02-19 22:38 - 2014-02-16 20:22 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-02-19 22:28 - 2012-04-25 06:38 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-19 19:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-19 19:02 - 2012-10-19 07:40 - 00000000 ___RD () C:\Users\H1234 Surf\Dropbox
2014-02-19 19:02 - 2012-10-19 07:38 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Roaming\Dropbox
2014-02-19 18:54 - 2009-07-14 05:45 - 00030208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-19 18:54 - 2009-07-14 05:45 - 00030208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-19 18:49 - 2012-04-24 23:12 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-19 17:30 - 2012-09-24 08:13 - 00003966 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{83436183-8D44-4503-BE81-03233892840E}
2014-02-18 22:32 - 2012-04-30 17:26 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{472CF516-9C5E-46F1-BEA9-9A9F2E7C6EB0}
2014-02-18 21:57 - 2014-02-18 21:57 - 00000887 _____ () C:\Users\Public\Desktop\osu!.lnk
2014-02-18 13:15 - 2013-11-13 17:52 - 00000000 ____D () C:\AdwCleaner
2014-02-18 12:59 - 2013-05-30 21:48 - 00001079 _____ () C:\Users\H1234\Desktop\Traffic Travis v4.lnk
2014-02-18 12:54 - 2013-05-30 21:48 - 00000000 ____D () C:\Users\H1234\AppData\Roaming\Traffic Travis v4
2014-02-18 12:03 - 2014-02-18 12:03 - 01241888 _____ () C:\Users\H1234 Surf\Downloads\adwcleaner_3.0.1.9.exe
2014-02-18 11:50 - 2012-04-25 00:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-18 11:34 - 2012-09-24 09:38 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Roaming\vlc
2014-02-16 21:35 - 2014-02-16 21:35 - 00023912 _____ () C:\Users\H1234\Desktop\Plue_eating_candy.jpeg
2014-02-16 21:33 - 2014-02-16 21:33 - 00016050 _____ () C:\Users\H1234\Downloads\imgres.htm
2014-02-16 21:17 - 2014-02-16 21:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-16 20:25 - 2012-10-29 17:33 - 00155048 _____ () C:\Users\H1234\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-16 20:15 - 2012-11-22 20:35 - 00000000 ____D () C:\Users\Jessi\AppData\Roaming\ICQ
2014-02-16 20:11 - 2014-02-16 19:54 - 56952904 _____ (ppy Pty. Ltd.) C:\Users\Jessi\Downloads\osu!install.exe
2014-02-16 19:53 - 2012-10-29 17:32 - 00000000 ____D () C:\Users\H1234
2014-02-16 18:40 - 2013-08-14 22:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-16 18:40 - 2012-04-25 06:41 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-16 17:48 - 2013-10-08 09:47 - 00000983 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-02-16 17:35 - 2012-05-03 11:39 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-16 17:35 - 2012-05-03 11:39 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-12 22:01 - 2012-05-04 21:24 - 00000000 ____D () C:\Users\Jessi\AppData\Roaming\Skype
2014-02-12 19:51 - 2012-04-30 17:54 - 00155048 _____ () C:\Users\Jessi\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-12 19:49 - 2009-07-14 05:45 - 05122904 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-12 17:05 - 2013-07-26 07:33 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-12 17:02 - 2011-11-24 03:47 - 00701310 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 17:02 - 2011-11-24 03:47 - 00150210 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 17:02 - 2011-02-11 18:15 - 01597700 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 17:02 - 2009-07-14 06:13 - 01597700 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 14:07 - 2012-09-24 08:14 - 00155048 _____ () C:\Users\H1234 Surf\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-12 14:05 - 2014-02-12 14:04 - 00002287 _____ () C:\Users\Public\Desktop\SteuerSparErklärung Selbstständige 2014.lnk
2014-02-12 14:04 - 2014-02-12 14:04 - 00000000 ____D () C:\Users\H1234\AppData\Local\AAV
2014-02-12 14:01 - 2012-04-25 07:44 - 00000000 ____D () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft
2014-02-08 13:53 - 2014-02-08 13:53 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Local\Howler
2014-02-08 13:50 - 2012-04-26 07:41 - 00000000 ____D () C:\Program Files (x86)\EPSON Software
2014-02-08 13:50 - 2010-11-21 04:47 - 00969218 _____ () C:\Windows\PFRO.log
2014-02-08 13:48 - 2012-04-26 07:41 - 00000000 ____D () C:\Program Files (x86)\epson
2014-02-08 13:48 - 2011-11-24 04:03 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-08 13:46 - 2012-05-07 14:30 - 00000000 ____D () C:\ProgramData\Lexware
2014-02-08 13:46 - 2012-05-07 14:30 - 00000000 ____D () C:\Program Files (x86)\Lexware
2014-02-08 13:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help
2014-02-08 13:40 - 2012-10-30 16:54 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Local\LogMeIn Hamachi
2014-02-08 12:28 - 2013-05-16 08:28 - 05556104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-08 12:28 - 2012-04-25 06:38 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-08 12:28 - 2012-04-25 06:38 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-08 12:28 - 2011-11-24 04:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-06 13:16 - 2014-02-12 17:00 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 17:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 17:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 17:00 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 17:00 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 17:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 17:00 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 17:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 17:00 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 17:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 17:00 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 17:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 17:00 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 17:00 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 17:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 17:00 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 17:00 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 17:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 17:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 17:00 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 17:00 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 17:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 17:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 17:00 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 17:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 17:00 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 17:00 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 17:00 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 17:00 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 17:00 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 17:00 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 17:00 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 17:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 17:00 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 17:00 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 17:00 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 17:00 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 17:00 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 17:00 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-04 11:35 - 2012-10-16 16:22 - 00000000 ____D () C:\Users\H1234 Surf\Documents\Steuerfälle
2014-02-04 09:35 - 2012-05-03 11:40 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-02-03 15:59 - 2012-10-30 17:07 - 00001056 _____ () C:\Users\H1234 Surf\Desktop\Traffic Travis v4.lnk
2014-02-03 15:59 - 2012-10-30 17:07 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Roaming\Traffic Travis v4
2014-02-03 15:59 - 2012-10-30 17:07 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Traffic Travis v4
2014-01-26 21:29 - 2012-10-29 23:29 - 00000000 ____D () C:\Users\Jessi\AppData\Local\LogMeIn Hamachi
2014-01-25 10:22 - 2012-09-24 08:16 - 00000000 ____D () C:\Users\H1234 Surf\AppData\Local\Mozilla
2014-01-24 17:05 - 2014-01-24 17:05 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\Program Files\iPod
2014-01-24 17:05 - 2013-01-01 01:12 - 00000000 ____D () C:\Program Files\iTunes
2014-01-24 17:05 - 2012-06-22 15:39 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-24 17:03 - 2012-05-05 16:59 - 00000000 ____D () C:\ProgramData\Apple

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-19 19:23

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2014
Ran by H1234 at 2014-02-20 07:41:27
Running from C:\Users\H1234\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

 Leawo iTransfer version  1.4.0.1106 (x32 Version: 1.4.0.1106 - )
7-Zip 9.20 (x32 Version:  - )
AAVUpdateManager (x32 Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.0.0 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe CreatePDF Desktop Printer (x32 Version: 12.4.1 - Adobe)
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated)
Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated) Hidden
Adobe Photoshop CS5 (x32 Version: 12.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122 - Adobe Systems, Inc.)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.3.133 - Adobe Systems, Inc)
Adobe SVG Viewer 3.0 (x32 Version:  3.0 - Adobe Systems, Inc.)
AFPL Ghostscript 8.54 (x32 Version:  - )
AFPL Ghostscript Fonts (x32 Version:  - )
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
Aiseesoft iTunes Backup Genius 2.1.2 (x32 Version: 2.1.2 - Aiseesoft Studio)
Ann Video Converter 4.5.0 (x32 Version: 4.5.0 - AnnVideo International LLC.)
AOMEI Partition Assistant Pro Edition 5.2 (x32 Version:  - Aomei Technology Co., Ltd.)
Apple Application Support (x32 Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Artensoft Photo Collage Maker (Version: 1.2 - Artensoft)
Audacity 2.0.2 (x32 Version: 2.0.2 - Audacity Team)
Audiograbber 1.83 SE  (x32 Version: 1.83 SE  - Audiograbber)
Audiograbber MP3-Plugin (x32 Version: 1.0 - AG)
AuthenTec TrueAPI (Version: 1.3.0.116 - AuthenTec, Inc.) Hidden
AVG 2014 (Version: 14.0.3705 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4335 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4335 - AVG Technologies)
AVS Update Manager 1.0 (x32 Version:  - Online Media Technologies Ltd.)
AVS Video Converter 8 (x32 Version:  - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (x32 Version:  - Online Media Technologies Ltd.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Benutzerhandbuch EPSON PX730 Series (x32 Version:  - )
Bing Bar (x32 Version: 7.3.124.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
BRAdmin Professional 3 (x32 Version: 3.50.0002 - Brother)
Brother MFL-Pro Suite MFC-9320CW (x32 Version: 2.0.1.0 - Brother Industries, Ltd.)
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Camfrog Video Chat 6.3 (x32 Version: 6.3.223 - Camshare Inc.)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
CleverPrint (x32 Version: 3.00 - Abelssoft GmbH)
ColorPicker Version 2.5 (x32 Version: 2.5 - Cronoxyd.de)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink PhotoDirector 3 (x32 Version: 3.0.3618 - CyberLink Corp.)
CyberLink PhotoDirector 3 (x32 Version: 3.0.3618 - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (x32 Version: 10.0.1.2925 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.1.2925 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DATEV Installation V.2.8 (x32 Version:  - )
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version:  - Microsoft)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DHTML Editing Component (x32 Version: 6.02.0001 - Microsoft Corporation)
Digimarc MediaBridge Reader (x32 Version:  - )
DreamTSman (x32 Version: 2.2.9 - 7soft (Reimar Barnstorf))
Druckerdeinstallation für EPSON PX730 Series (Version:  - SEIKO EPSON Corporation)
DYMO Label v.8 (x32 Version: 8.3.0.1242 - Sanford, L.P.)
Elevated Installer (x32 Version: 2.3.17.0 - Garmin Ltd or its subsidiaries) Hidden
eM Client (x32 Version: 3.5.12360.0 - SoftMaker Software GmbH) Hidden
Epson Download Navigator (x32 Version: 1.0.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Print CD (x32 Version: 2.05.00 - SEIKO EPSON CORPORATION)
EPSON Scan (x32 Version:  - Seiko Epson Corporation)
EpsonNet Print (x32 Version: 2.4j - SEIKO EPSON CORPORATION)
EverDesk Google Edition (x32 Version: 5.1.1 - EverEZ Systems Limited)
EverDesk Google Edition (x32 Version: 5.1.1 - EverEZ Systems Limited) Hidden
EVEREST Home Edition v2.20 (x32 Version: 2.20 - Lavalys Inc)
Exact Audio Copy 1.0beta3 (x32 Version: 1.0beta3 - Andre Wiethoff)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0 - )
FileStream Web Boomerang (x32 Version: 3.0 - FileStream, Inc.)
FlipBook Maker  3.6.3 (x32 Version: 3.6.3 - Kvisoft Co,. Ltd)
Free Video Converter V 3.1 (x32 Version: 3.1.0.0 - Koyote Soft)
Free YouTube to MP3 Converter version 3.12.2.430 (x32 Version: 3.12.2.430 - DVDVideoSoft Ltd.)
Garmin Communicator Plugin x64 (Version: 4.0.3 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 2.3.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 2.3.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin POI Loader (x32 Version: 2.5.3.0 - Garmin Ltd or its subsidiaries)
Garmin POI Loader (x32 Version: 2.7.3 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (x32 Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.2 (Version: 2.8.2 - The GIMP Team)
Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
GPL Ghostscript (x32 Version: 9.05 - Artifex Software Inc.)
Haali Media Splitter (x32 Version:  - )
HERMA Label Designer plus 1.1 (x32 Version: 1.00.0000 - HERMA GmbH)
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Games (x32 Version: 1.0.2.5 - WildTangent)
HP LinkUp (x32 Version: 2.01.028 - Hewlett-Packard)
HP Odometer (x32 Version: 2.10.0000 - Hewlett-Packard)
HP Setup (x32 Version: 8.7.4747.3786 - Hewlett-Packard Company)
HP Setup Manager (x32 Version: 1.1.13880.3792 - Hewlett-Packard Company)
HP SimplePass PE 2011 (x32 Version: 5.3.0.194 - Hewlett-Packard)
HP Support Assistant (x32 Version: 6.0.4.1 - Hewlett-Packard Company)
HP Support Information (x32 Version: 10.1.1000 - Hewlett-Packard)
HP Update (x32 Version: 5.003.001.001 - Hewlett-Packard)
HP Vision Hardware Diagnostics (Version: 2.9.0.0 - Hewlett-Packard)
iCloud (Version: 3.1.0.40 - Apple Inc.)
IDT Audio (x32 Version: 1.0.6346.0 - IDT)
ImgBurn (x32 Version: 2.5.8.0 - LIGHTNING UK!)
Inkscape 0.48.4 (x32 Version: 0.48.4 - )
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
iResizer 2.1 (x32 Version:  - teorex)
IrfanView (remove only) (x32 Version: 4.36 - Irfan Skiljan)
iTunes (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 25 (x32 Version: 7.0.250 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (x32 Version: 2.5.3925 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.3925 - CyberLink Corp.) Hidden
LAME v3.99.3 (for Windows) (x32 Version:  - )
LibreOffice 4.1.4.2 (x32 Version: 4.1.4.2 - The Document Foundation)
Light Developer v7.1, build 12452 (x32 Version:  - Stepok Image Lab.)
Logitech GamePanel Software 3.03.133 (Version: 3.03.133 - Logitech Inc.)
Magic Desktop (x32 Version: 3.0 - EasyBits Software AS)
MAGIX Screenshare (Version: 4.3.6.1987 - MAGIX AG) Hidden
MAGIX Screenshare (x32 Version: 4.3.6.1987 - MAGIX AG)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Market Samurai (x32 Version: 0.93.00 - Alliance Software Pty Ltd)
Market Samurai (x32 Version: 0.93.00 - Alliance Software Pty Ltd) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Mathematics (x32 Version: 4.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Pro Photo Tools (x32 Version: 2.2 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft XML Parser (x32 Version: 8.70.1104.04 - Microsoft Corporation) Hidden
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Mobile Partner (x32 Version: 11.300.05.03.40 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 27.0.1 (x86 de) (x32 Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (x32 Version: 27.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Netzwerkhandbuch EPSON PX730 Series (x32 Version:  - )
Nuclear Coffee - VideoGet (x32 Version: 2012 - Nuclear Coffee)
NVIDIA Grafiktreiber 296.28 (Version: 296.28 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.62.312 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.10.0514 (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 296.28 (Version: 296.28 - NVIDIA Corporation) Hidden
NVIDIA Update 1.7.12 (Version: 1.7.12 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.7.12 - NVIDIA Corporation) Hidden
OpenAL (x32 Version:  - )
OpenOffice.org 3.3 (x32 Version: 3.3.9567 - OpenOffice.org)
osu! (x32 Version: 0.0.0.0 - peppy)
PaperPort Image Printer 64-bit (Version: 1.00.0000 - Nuance Communications, Inc.)
PatchBeam (x32 Version: 1.10 - ConeXware, Inc.)
PDF Blender (x32 Version:  - )
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF Split And Merge Basic (Version: 2.2.2 - Andrea Vacondio)
PDFCreator (x32 Version: 1.6.2 - pdfforge)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PhotoMagic 1.0.0.0 (x32 Version:  - )
PhotoScape (x32 Version:  - )
Picture Cutout Guide 3.0.2 (Version: 3.0.2 - Tint Guide)
Pixelplan - Flow Architect Studio 3D (x32 Version:  - )
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime amd64 (Version: 1.3.0 - Microsoft Corporation)
POIbase 1.066 (x32 Version:  - POIbase)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Power2Go (x32 Version: 6.1.5331 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.5331 - CyberLink Corp.) Hidden
PowerArchiver 2012 (x32 Version: 13.01.04 - ConeXware, Inc.)
PowerArchiver 2012 (x32 Version: 13.01.04 - ConeXware, Inc.) Hidden
PresentationTube Recorder 1.0 (x32 Version: 1.0 - PresentationTube)
Project Dogwaffle Howler version 8.2 (x32 Version: 8.2 - Daniel Ritchie)
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
RealDownloader (x32 Version: 1.3.0 - RealNetworks, Inc.) Hidden
Reality Fusion GameCam SE (x32 Version:  - )
Reality Fusion VBall (x32 Version:  - )
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (x32 Version: 16.0.0 - RealNetworks)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Recovery Manager (x32 Version: 5.5.0.4320 - CyberLink Corp.) Hidden
Remote Graphics Receiver (x32 Version: 5.4.5 - Hewlett-Packard)
Retouch Pilot Free 3.5.3 (Version: 3.5.3 - Two Pilots)
Safari (x32 Version: 5.34.57.2 - Apple Inc.)
ScanSoft PaperPort 11 (x32 Version: 11.2.0000 - Nuance Communications, Inc.)
Scribus 1.4.2 (64bit) (Version: 1.4.2 - The Scribus Team)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Sketch Drawer (x32 Version: 1.3 - SoftOrbits)
Skype™ 6.3 (x32 Version: 6.3.107 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Snap.Do (x32 Version: 1.6.1.962 - ReSoft Ltd.) <==== ATTENTION
SoftMaker Office Professional 2012 (x32 Version: 12.0.2627 - SoftMaker Software GmbH)
Sothink Flash Menu (x32 Version: 1.2 - SourceTec Software Co., LTD)
Spybot - Search & Destroy (x32 Version: 2.1.20 - Safer-Networking Ltd.)
Steuer-Spar-Erklärung Selbstständige 2013 (x32 Version: 18.09 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung Selbstständige 2014 (x32 Version: 19.04.49 - Akademische Arbeitsgemeinschaft)
SUPER © +Recorder.2013.55 (Mar 7, 2013) Version +Recorder.2013. (x32 Version: +Recorder.2013.55 - eRightSoft)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Tinypic 3.18 (x32 Version: Tinypic 3.18 - E. Fiedler)
Traffic Travis 4.1.0 (x32 Version:  - Affilorama Ltd.)
Ulead Photo Explorer 6.0 (x32 Version:  - )
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837583) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VideoLink Mail (x32 Version:  - )
VIP Access SDK (1.0.1.4)  (x32 Version: 1.0.1.4 - Symantec Inc.)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio 2008 x64 Redistributables (x32 Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.6 (x32 Version: 2.0.6 - VideoLAN)
Webocton - Scriptly 0.8.95.6 (x32 Version: 0.8.95.6 - Webocton)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows 7 USB/DVD Download Tool (x32 Version: 1.0.30 - Microsoft Corporation)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows XP Mode (Version: 1.3.7600.16422 - Microsoft Corporation)
WinPDFEditor V2.0.2 (x32 Version:  - hxxp://www.WinPDFEditor.com)
WinRAR 4.11 (64-Bit) (Version: 4.11.0 - win.rar GmbH)
WinX HD Video Converter Deluxe 5.0.2 (x32 Version:  - Digiarty Software, Inc.)
Wondershare DVD Creator(Build 2.6.5) (x32 Version:  - Wondershare)
wpclipper-9.0 (x32 Version:  - Paul Sherman)
XSManager (x32 Version: 3.0 - XSManager)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Restore Points  =========================

08-02-2014 12:40:42 Removed LogMeIn Hamachi
08-02-2014 12:43:55 Removed Drivers For Free.
08-02-2014 12:44:42 Removed Lexware büro easy 2011.
08-02-2014 12:45:45 Removed Lexware online banking.
08-02-2014 12:46:14 Removed Lexware Elster.
08-02-2014 12:46:42 Removed Lexware Abschreibungsrechner.
08-02-2014 12:47:08 Removed Lexware Info Service.
08-02-2014 12:47:37 Removed Epson Customer Research Participation
08-02-2014 12:48:16 Removed Epson Event Manager
12-02-2014 13:00:17 SteuerSparErklärung 2014 wurde installiert.
12-02-2014 15:59:41 Windows Update
16-02-2014 16:47:13 Installed AVG 2014
16-02-2014 17:39:55 Windows Update
18-02-2014 11:51:49 Removed osu!
18-02-2014 20:56:47 Installed osu!

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-04-29 17:16 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {009886B6-97D8-4819-887E-D66D865C2151} - \DealPlyLiveUpdateTaskMachineCore No Task File
Task: {0803C8B6-359F-4766-A8CC-598F4CB72D2F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-09] (Hewlett-Packard Company)
Task: {09C025DC-1EDB-4622-A3AE-AF9580046644} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {16BC65D7-DF3F-4E15-A320-B7BA7BE42E5A} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2928652112-3187983571-3213460233-1003 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {187AAD0D-A50E-4F4A-BD7E-C5097878CE9B} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-15] ()
Task: {1B1B242B-A851-4C72-81DD-25250697FA7E} - System32\Tasks\Lexware-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe
Task: {1E0C7D4C-BBB0-4CB6-BA1F-1D491AA5F3E1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1E308B19-504D-46D1-81A7-C3F3122408D9} - \TubeSaver-15-chromeinstaller No Task File
Task: {23712C79-B15D-4FE0-BD94-AB6165DBFE4D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {24EFA391-80A3-4455-8112-EF66CBB987BF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03] (Google Inc.)
Task: {28FC4BCE-C9B1-4DB6-A875-04186A121A7F} - System32\Tasks\ScanSoft Background Update => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {2A47C10E-A312-4298-A5A9-640B46CBCC3E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03] (Google Inc.)
Task: {2B15657D-0B53-497C-8798-272E69BBAEB0} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {3363272A-F4EA-4BB6-92A1-3FE9B14959B8} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2928652112-3187983571-3213460233-1003 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {376E6E75-9E3E-42A9-BEB9-4E2436F835A2} - \DSite No Task File
Task: {39FEC947-138B-4E8C-9038-CDA4E040DDE4} - \Scheduled Update for Ask Toolbar No Task File
Task: {3BC59860-5DBD-4E10-A5DF-33D091672422} - \TubeSaver-15-firefoxinstaller No Task File
Task: {4797BED0-DF13-4ABA-9285-74BA470EF442} - System32\Tasks\{97E1175C-BC34-414B-9834-B9DE2D0A820B} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Photoshop CS2\Photoshop.exe
Task: {4BE87E9A-FD0A-427F-8149-E8D1F966B9A3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-08] (Adobe Systems Incorporated)
Task: {54C47C2B-C96B-4DDE-9071-E6059B3CF675} - System32\Tasks\Express DownloaderUpdate => C:\Program Files (x86)\ExpressDownloader\EDUpdater.exe [2012-09-22] (hxxp://www.express-downloader.com/)
Task: {55E0C8B9-BA09-4203-AC20-F34ACBCB23BE} - \QtraxPlayer No Task File
Task: {5F96D245-0808-4BC6-BE81-AD7DE4A41B0C} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2928652112-3187983571-3213460233-1007 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {600760F2-A5C9-44C3-B001-3A835505DE42} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => C:\Program Files (x86)\real\realplayer\update\realsched.exe [2013-01-19] (RealNetworks, Inc.)
Task: {634511CC-5E73-474B-9C2F-8616B2B2D4E4} - \TubeSaver-15-updater No Task File
Task: {635F0CAB-328F-43B4-A80C-376A151BBE97} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {7245C09E-1648-4BB6-BC26-98C3FA338EC0} - System32\Tasks\AdobeAAMUpdater-1.0-H1234-HP-H1234 Surf => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {87D6CC04-0EDF-47D9-8989-6D8BC7DD9506} - \Dealply No Task File
Task: {958F2F46-5BA8-4339-9596-FC74206BBD2F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-09] (Hewlett-Packard Company)
Task: {9A46BE73-2E73-41A7-AC16-801EF07FE87A} - System32\Tasks\{F053FDCF-DED6-443C-A58E-F71D405A8558} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Photoshop CS2\Photoshop.exe
Task: {9B057959-2F6B-443F-9174-868A4FCD56FD} - \TubeSaver-15-codedownloader No Task File
Task: {9C26816F-BE3B-4D1C-9305-F11FC47121C2} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation)
Task: {A67DB159-C275-49CE-9915-F70CDCBB7DD7} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2011-05-10] (Hewlett-Packard)
Task: {B2171DEC-7FF4-4F5B-9851-C97294F92EEA} - System32\Tasks\{A717C1A4-D630-48B4-B93B-95D353793221} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Acrobat 7.0\Acrobat\Acrobat.exe
Task: {B34D3985-F896-4E6B-B3F7-8B44E8A4E198} - \DealPlyLiveUpdateTaskMachineUA No Task File
Task: {B6222B17-E72E-4B38-8B45-82FFD657A894} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-09] (Hewlett-Packard Company)
Task: {B7D11A3B-CE29-4290-AEB0-9AD5A25E81A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-23] (Hewlett-Packard Company)
Task: {BCDCC6B1-94DE-49D1-93A3-07F44DB6A5EF} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2928652112-3187983571-3213460233-1007 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {BD56A2F1-01A0-4E41-BE65-53B0CD5706B4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {BFEBC060-ACB3-4DC9-BC10-5F658807C91D} - \TubeSaver-15-enabler No Task File
Task: {C16FE6B6-EB71-4B30-91C1-4E6B7488E74F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-09] (Hewlett-Packard)
Task: {C788A697-E0C5-4256-BD98-23DD2A51692C} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {CF2B586D-C10E-4AF9-8961-6314ABF24E50} - System32\Tasks\{CB3FEE66-FE65-4428-8EDE-D82C14271540} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Acrobat 7.0\Acrobat\Acrobat.exe
Task: {E7EDDDFF-319B-499F-BAE1-618719E322CF} - System32\Tasks\SetupManager => C:\Program Files (x86)\Hewlett-Packard\Setup Manager\toaster.exe [2011-06-21] (Microsoft)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe

==================== Loaded Modules (whitelisted) =============

2008-10-24 15:35 - 2008-10-24 15:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2013-03-25 12:13 - 2012-12-11 10:02 - 00098304 _____ () C:\Program Files (x86)\Brother\bratimer.exe
2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2012-08-20 21:45 - 2000-08-17 16:40 - 00032768 _____ () C:\Program Files (x86)\Philips ToUcam Camera\GameCam SE\Program\RFTray.exe
2013-04-12 22:19 - 2011-04-01 10:26 - 01163264 ____R () C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
2013-04-12 22:19 - 2005-04-22 12:36 - 00143360 ____N () C:\Windows\system32\BrSNMP64.dll
2013-02-13 13:15 - 2012-01-14 07:26 - 00327392 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-07-20 11:46 - 2013-05-16 09:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-07-20 11:46 - 2013-05-16 09:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-07-20 11:46 - 2013-05-16 09:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-07-20 11:46 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-07-20 11:46 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-08-20 21:46 - 1998-11-30 17:34 - 00075264 ____N () C:\Program Files (x86)\Ulead Systems\Ulead Photo Express 2 SE\U32MISC.dll
2012-08-20 21:46 - 1998-07-22 16:33 - 00013824 ____N () C:\Program Files (x86)\Ulead Systems\Ulead Photo Express 2 SE\u32Spy.dll
2012-08-20 21:45 - 2000-08-17 16:40 - 00040960 _____ () C:\Program Files (x86)\Philips ToUcam Camera\GameCam SE\Program\RfDownload.dll
2012-08-20 21:45 - 2000-08-17 17:02 - 00086016 _____ () C:\Program Files (x86)\Philips ToUcam Camera\GameCam SE\Program\RFTrayRes.dll
2013-04-12 22:16 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-02-04 09:35 - 2014-02-02 00:41 - 00715592 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\libglesv2.dll
2014-02-04 09:35 - 2014-02-02 00:41 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\libegl.dll
2014-02-04 09:35 - 2014-02-02 00:42 - 04055368 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll
2014-02-04 09:35 - 2014-02-02 00:42 - 00399688 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll
2014-02-04 09:35 - 2014-02-02 00:41 - 01634632 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ffmpegsumo.dll
2014-02-04 09:35 - 2014-02-02 00:42 - 13616456 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: PortableVBoxDRV
Description: PortableVBoxDRV
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: VBoxDRV
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: PortableVBoxUSBMon
Description: PortableVBoxUSBMon
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: VBoxUSBMon
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/20/2014 07:35:05 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x2f8
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3

Error: (02/19/2014 06:46:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x2e4
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3

Error: (02/19/2014 05:34:12 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x2e4
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3

Error: (02/19/2014 04:27:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x304
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3

Error: (02/18/2014 09:54:03 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x300
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3

Error: (02/18/2014 09:51:26 PM) (Source: MsiInstaller) (User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.

Error: (02/18/2014 09:50:23 PM) (Source: MsiInstaller) (User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.

Error: (02/18/2014 09:50:16 PM) (Source: MsiInstaller) (User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.

Error: (02/18/2014 09:50:15 PM) (Source: MsiInstaller) (User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.

Error: (02/18/2014 09:50:14 PM) (Source: MsiInstaller) (User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.


System errors:
=============
Error: (02/20/2014 07:35:46 AM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/20/2014 07:35:31 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PortableVBoxUSBMon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3

Error: (02/20/2014 07:35:31 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PortableVBoxDRV" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3

Error: (02/19/2014 10:40:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst AVGIDSAgent konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (02/19/2014 10:39:29 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst avgwd erreicht.

Error: (02/19/2014 06:47:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/19/2014 06:47:48 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (02/19/2014 06:47:18 PM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/19/2014 06:47:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (02/19/2014 06:47:17 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Updating Service erreicht.


Microsoft Office Sessions:
=========================
Error: (02/20/2014 07:35:05 AM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a2f801cf2e05da3e8dc3C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe218da734-99f9-11e3-b740-386077677cb6

Error: (02/19/2014 06:46:06 PM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a2e401cf2d9a6d8d1092C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeb49fccdc-998d-11e3-aac6-386077677cb6

Error: (02/19/2014 05:34:12 PM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a2e401cf2d9061d57219C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exea977b4a3-9983-11e3-ae6a-386077677cb6

Error: (02/19/2014 04:27:06 PM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a30401cf2d87028c097bC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe49f4503e-997a-11e3-bb67-386077677cb6

Error: (02/18/2014 09:54:03 PM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a30001cf2ceb84e3beedC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.execbe0e7c4-98de-11e3-805f-386077677cb6

Error: (02/18/2014 09:51:26 PM) (Source: MsiInstaller)(User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/18/2014 09:50:23 PM) (Source: MsiInstaller)(User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/18/2014 09:50:16 PM) (Source: MsiInstaller)(User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/18/2014 09:50:15 PM) (Source: MsiInstaller)(User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (02/18/2014 09:50:14 PM) (Source: MsiInstaller)(User: H1234-HP)
Description: Product: osu! -- Error 1500. Another installation is in progress. You must complete that installation before continuing this one.(NULL)(NULL)(NULL)(NULL)(NULL)


CodeIntegrity Errors:
===================================
  Date: 2013-04-29 18:12:21.588
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-29 18:12:21.557
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.678
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\H1234\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.663
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\H1234\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.616
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.600
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 24%
Total physical RAM: 12268.32 MB
Available physical RAM: 9231.73 MB
Total Pagefile: 24534.83 MB
Available Pagefile: 21124.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:926.94 GB) (Free:710.23 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:13.13 GB) (Free:1.58 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive j: (Datenpartition) (Fixed) (Total:922.84 GB) (Free:649.76 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 40DB00A1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=927 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=923 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=13 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus 20.02.2014 10:26
Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

hardyxy9 20.02.2014 10:59
Code:
Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.02.20.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
H1234 :: H1234-HP [administrator]

20.02.2014 10:43:22
mbar-log-2014-02-20 (10-43-22).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 412059
Time elapsed: 11 minute(s), 58 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 20.02.2014 13:17
Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


hardyxy9 20.02.2014 14:51
Code:
# AdwCleaner v3.019 - Bericht erstellt am 20/02/2014 um 14:03:28
# Aktualisiert 17/02/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : H1234 - H1234-HP
# Gestartet von : C:\Users\H1234 S1234\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gefunden : C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage-journal
Datei Gefunden : C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\searchplugins\softonic.xml
Datei Gefunden : C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\user.js
Datei Gefunden : C:\Users\H1234 S1234\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_dnpmlnedpdikbgdghljdepnljfpkhccn_0
Datei Gefunden : C:\Users\H1234 S1234\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gefunden : C:\Users\H1234 S1234\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage-journal
Datei Gefunden : C:\Users\H1234 S1234\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_sb.scorecardresearch.com_0.localstorage
Datei Gefunden : C:\Users\J1234\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_dnpmlnedpdikbgdghljdepnljfpkhccn_0
Datei Gefunden : C:\Users\J1234\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gefunden : C:\Users\J1234\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage-journal
Datei Gefunden : C:\Users\J1234\AppData\Roaming\Mozilla\Firefox\Profiles\mqzevvme.default\Extensions\webbooster@iminent.com.xpi
Ordner Gefunden : C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl
Ordner Gefunden : C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf
Ordner Gefunden : C:\Users\H1234 S1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl
Ordner Gefunden : C:\Users\J1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnpmlnedpdikbgdghljdepnljfpkhccn
Ordner Gefunden : C:\Users\J1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl
Ordner Gefunden : C:\Users\J1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbpcjmidkkgldeplajgnbpjkfpmpeepb
Ordner Gefunden C:\Users\H1234\AppData\LocalLow\Softonic
Ordner Gefunden C:\Users\H1234\AppData\Roaming\OpenCandy
Ordner Gefunden C:\Users\H1234 S1234\AppData\Roaming\Iminent

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKLM\Software\caphyon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\d

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16518

Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=10&cc=&mi=2ededfe8000000000000386077677cb6

-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\H1234 S1234\AppData\Roaming\Mozilla\Firefox\Profiles\80jcen2v.default\prefs.js ]


[ Datei : C:\Users\J1234\AppData\Roaming\Mozilla\Firefox\Profiles\mqzevvme.default\prefs.js ]


[ Datei : C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\prefs.js ]

Zeile gefunden : user_pref("extensions.Softonic.admin", false);
Zeile gefunden : user_pref("extensions.Softonic.aflt", "OC");
Zeile gefunden : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Zeile gefunden : user_pref("extensions.Softonic.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.Softonic.dfltLng", "de");
Zeile gefunden : user_pref("extensions.Softonic.dfltSrch", true);
Zeile gefunden : user_pref("extensions.Softonic.dnsErr", true);
Zeile gefunden : user_pref("extensions.Softonic.excTlbr", false);
Zeile gefunden : user_pref("extensions.Softonic.ffxUnstlRst", false);
Zeile gefunden : user_pref("extensions.Softonic.hmpg", true);
Zeile gefunden : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=2ededfe8000000000000386077677cb6");
Zeile gefunden : user_pref("extensions.Softonic.id", "2ededfe8000000000000386077677cb6");
Zeile gefunden : user_pref("extensions.Softonic.instlDay", "16049");
Zeile gefunden : user_pref("extensions.Softonic.instlRef", "MOY00621");
Zeile gefunden : user_pref("extensions.Softonic.newTab", true);
Zeile gefunden : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=2ededfe8000000000000386077677cb6");
Zeile gefunden : user_pref("extensions.Softonic.prdct", "Softonic");
Zeile gefunden : user_pref("extensions.Softonic.prtnrId", "softonic");
Zeile gefunden : user_pref("extensions.Softonic.rvrt", "false");
Zeile gefunden : user_pref("extensions.Softonic.smplGrp", "none");
Zeile gefunden : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Zeile gefunden : user_pref("extensions.Softonic.tlbrId", "opencandy2013");
Zeile gefunden : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=2ededfe8000000000000386077677cb6&q=");
Zeile gefunden : user_pref("extensions.Softonic.vrsn", "1.8.21.14");
Zeile gefunden : user_pref("extensions.Softonic.vrsnTs", "1.8.21.1417:19:44");
Zeile gefunden : user_pref("extensions.Softonic.vrsni", "1.8.21.14");

-\\ Google Chrome v32.0.1700.107

[ Datei : C:\Users\H1234 S1234\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ Datei : C:\Users\J1234\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gefunden : icon_url
Gefunden : search_url
Gefunden : suggest_url
Gefunden : keyword

[ Datei : C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gefunden : homepage

*************************

AdwCleaner[R0].txt - [71534 octets] - [13/11/2013 17:52:53]
AdwCleaner[R1].txt - [7058 octets] - [18/02/2014 13:14:55]
AdwCleaner[R2].txt - [6787 octets] - [20/02/2014 14:03:28]
AdwCleaner[S0].txt - [67902 octets] - [13/11/2013 17:54:21]

########## EOF - \AdwCleaner\AdwCleaner[R2].txt - [6908 octets] ##########
AdwCleaner ließ sich im normalen Modus nicht starten bzw. der Rechner reagierte insofern nicht mehr, als dass er sich nicht mehr herunterfahren ließ.
Dafür erschien in der Taskleiste längere Zeit eine Adresse, etwa impreump.datropy.com und Malwarebytes meldete in einem aufgehenden kl.Fenster unten rechts eine geblockte Seite: 162.210.192.99

Also ließ ich AdwCleaner mit obigem Ergebnis im abgesicherten Modus mit Netzwerktreibern laufen.

Ich finde das alles sehr komisch...

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Ultimate x64
Ran by H1234 on 20.02.2014 at 14:26:02,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2928652112-3187983571-3213460233-1007\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2928652112-3187983571-3213460233-1007\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\chatzum_softonic_yahoo_62_v5_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\chatzum_softonic_yahoo_62_v5_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\chatzum_softonic_yahoo_62_v5_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\chatzum_softonic_yahoo_62_v5_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6D86E8C4-91E9-4665-A437-FC2456DA195B}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\H1234\AppData\Roaming\opencandy"
Successfully deleted: [Folder] "C:\Users\H1234\appdata\local\cre"
Successfully deleted: [Folder] "C:\Users\H1234\appdata\locallow\softonic"
Successfully deleted: [Folder] "C:\Program Files (x86)\free video converter"



~~~ FireFox

Successfully deleted: [File] C:\Users\H1234\AppData\Roaming\mozilla\firefox\profiles\qxs2ikp0.default\user.js
Successfully deleted: [File] C:\Users\H1234\AppData\Roaming\mozilla\firefox\profiles\qxs2ikp0.default\searchplugins\softonic.xml
Successfully deleted the following from C:\Users\H1234\AppData\Roaming\mozilla\firefox\profiles\qxs2ikp0.default\prefs.js

user_pref("extensions.Softonic.admin", false);
user_pref("extensions.Softonic.aflt", "OC");
user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
user_pref("extensions.Softonic.autoRvrt", "false");
user_pref("extensions.Softonic.dfltLng", "de");
user_pref("extensions.Softonic.dfltSrch", true);
user_pref("extensions.Softonic.dnsErr", true);
user_pref("extensions.Softonic.excTlbr", false);
user_pref("extensions.Softonic.ffxUnstlRst", false);
user_pref("extensions.Softonic.hmpg", true);
user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=2ededfe8000000000000386077677cb6");
user_pref("extensions.Softonic.id", "2ededfe8000000000000386077677cb6");
user_pref("extensions.Softonic.instlDay", "16049");
user_pref("extensions.Softonic.instlRef", "MOY00621");
user_pref("extensions.Softonic.newTab", true);
user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=2ededfe8000000000000386077677cb6");
user_pref("extensions.Softonic.prdct", "Softonic");
user_pref("extensions.Softonic.prtnrId", "softonic");
user_pref("extensions.Softonic.rvrt", "false");
user_pref("extensions.Softonic.smplGrp", "none");
user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
user_pref("extensions.Softonic.tlbrId", "opencandy2013");
user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=2ededfe8000000000000386077677cb6&q=");
user_pref("extensions.Softonic.vrsn", "1.8.21.14");
user_pref("extensions.Softonic.vrsnTs", "1.8.21.1417:19:44");
user_pref("extensions.Softonic.vrsni", "1.8.21.14");
Emptied folder: C:\Users\H1234\AppData\Roaming\mozilla\firefox\profiles\qxs2ikp0.default\minidumps [4 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\H1234\appdata\local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.02.2014 at 14:27:54,64
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Grrr, immer wenn ich auf irgendeinen Link klicke kommt sowas wie:

hxxp://s.m2pub.com/player.html?a=23942126&context=c23842149&size=800x600&rt=popunder&ci=10&SOURCEURL=2070-2021.com&r=http%3A%2F%2Fstt.streamjs.net%2Fsd%2Fdw31.html%3Fu%3Dhttps%253A%252F%252Fm2pub.adk2.co%252Fmatomy%252Fscripts%252Fdirect%252Fdirect.html%25 3Fa%253D23942126%2526serverdomain%253Ds.m2pub.com%2526context%253Dc23842149%2526size%253D800x600%2526rt%253Dpopunder%2526ci%253D10%2526SOURCEURL%253D2 070-2021.com%26p%3DTubeSaver%26a%3Dredirect%26c%3D2070-2021%26b%3Dchrome%26bv%3D32%26t1%3D1392903755615%26tt%3D1392903755615%26r%3Dfilepony.de%26ua%3D99%26n%3Dmatomy_adk2_de%26sn%3D%26mpa%3D0%26mp%3D0&u=ht tp%3A%2F%2Fstt.streamjs.net%2Fsd%2Fdw31.html%3Fu%3Dhttps%253A%252F%252Fm2pub.adk2.co%252Fmatomy%252Fscripts%252Fdirect%252Fdirect.html%253Fa%253D23942 126%2526serverdomain%253Ds.m2pub.com%2526context%253Dc23842149%2526size%253D800x600%2526rt%253Dpopunder%2526ci%253D10%2526SOURCEURL%253D2070-2021.com%26p%3DTubeSaver%26a%3Dredirect%26c%3D2070-2021%26b%3Dchrome%26bv%3D32%26t1%3D1392903755615%26tt%3D1392903755615%26r%3Dfilepony.de%26ua%3D99%26n%3Dmatomy_adk2_de%26sn%3D%26mpa%3D0%26mp%3D0


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2014
Ran by H1234 (administrator) on HERMANN-HP on 20-02-2014 14:44:27
Running from C:\Users\H1234\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\H1234\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2010-10-22] (Hewlett-Packard )
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-10] (IDT, Inc.)
HKLM\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415752 2009-08-13] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2093064 2009-08-13] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4195848 2009-08-13] (Logitech Inc.)
HKLM\...\Run: [PrintDisp] - C:\Windows\system32\PrintDisp.exe [828416 2011-08-08] (ActMask Co.,Ltd - hxxp://www.all2pdf.com)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [PE2CKFNT SE] - C:\Program Files (x86)\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe [25088 1998-07-03] ()
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1163264 2011-04-01] ()
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4962320 2014-01-22] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] - C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-28] (Easybits)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\real\realplayer\update\realsched.exe [295072 2013-01-19] (RealNetworks, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update [21720 2014-01-28] (Hewlett-Packard)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2928652112-3187983571-3213460233-1003\...\Run: [Epson Stylus Photo PX730(Netzwerk)] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHQE.EXE [283232 2012-11-05] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2928652112-3187983571-3213460233-1003\...\Run: [DymoQuickPrint] - C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe [1825360 2011-01-28] (Sanford, L.P.)
HKU\S-1-5-21-2928652112-3187983571-3213460233-1003\...\Run: [TrafficTravisv4] - C:\Users\H1234S\AppData\Roaming\Traffic Travis v4\TrafficTravisV4.exe [20043264 2014-01-29] ()
HKU\S-1-5-21-2928652112-3187983571-3213460233-1003\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2928652112-3187983571-3213460233-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2928652112-3187983571-3213460233-1003\...\MountPoints2: {966bd8e9-75c1-11e2-b733-386077677cb6} - F:\AutoRun.exe
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHQE.EXE [283232 2012-11-05] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Run: [GarminExpressTrayApp] - C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1095000 2013-12-13] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Run: [TrafficTravisv4] - C:\Users\H1234\AppData\Roaming\Traffic Travis v4\TrafficTravisV4.exe [21954560 2014-02-13] ()
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2928652112-3187983571-3213460233-1007\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
Startup: C:\Users\H1234S\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\H1234\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\J123\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
GroupPolicyUsers\S-1-5-21-2928652112-3187983571-3213460233-1003\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {136E043D-39D8-4884-88F7-B47A3B070908} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - URL hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - TopResultURLFallback hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - TopResultURL hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: IEHlprObj Class - {DA5A2A9E-DF07-4a8e-B423-BC5CD4D1880C} - C:\Program Files\WebBoomerang\IEHelper.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-11-24] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @dymo.com/DymoLabelFramework - C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll ( Sanford L.P.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\searchplugins\ChatZumSearch.xml
FF SearchPlugin: C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\searchplugins\utorrentbarde-customized-web-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Bazaar Friend - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\addon@bazaarfriend.com [2013-08-12]
FF Extension: Real Summer Sale - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\realsummersale1@realsummersale.com [2013-09-18]
FF Extension: Garmin Communicator - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-12-10]
FF Extension: Bargain Workbench - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{8eaa2500-4118-4c33-9927-988702ba63bd} [2013-09-18]
FF Extension: Snap.Do  - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{d14aaada-f47b-4e88-80ec-62198918d1e8} [2013-06-29]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-02-20]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-16]
FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-01-19]

Chrome:
=======
CHR HomePage: hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=48&cc=&mi=2ededfe8000000000000386077677cb6
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (DYMO Label Framework) - C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll ( Sanford L.P.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll No File
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Extension: (TubeSaver-15) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\aacaalipcbmakfddcbikkebnjedofmec [2013-11-13]
CHR Extension: (Google Docs) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-20]
CHR Extension: (Google Drive) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-20]
CHR Extension: (YouTube) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-20]
CHR Extension: (Google-Suche) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-20]
CHR Extension: (RealDownloader) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-05-20]
CHR Extension: (Iminent) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl [2013-10-21]
CHR Extension: (Google Wallet) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-12]
CHR Extension: (Google Mail) - C:\Users\H1234\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-20]
CHR HKLM-x32\...\Chrome\Extension: [aaaaaakfopmidbfddimafofbdngbkidf] - C:\Users\Hermann\AppData\Local\APN\GoogleCRXs\aaaaaakfopmidbfddimafofbdngbkidf_7.13.0.0.crx [2013-05-20]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM-x32\...\Chrome\Extension: [jpgfhihjicjofdejkbjgnjlaglaciobe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-06-03]

==================== Services (Whitelisted) =================

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
S2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3788816 2014-01-22] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
S2 BRA_Scheduler; C:\Program Files (x86)\Brother\bratimer.exe [98304 2012-12-11] ()
S2 CLKMSVC10_38F51D56; c:\Program Files (x86)\Cyberlink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-02-25] (CyberLink)
S3 DATEV Update-Service; J:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe [155232 2011-02-21] (DATEV eG)
S2 DymoPnpService; C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe [32336 2011-01-28] (Sanford, L.P.)
S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [250712 2013-12-13] (Garmin Ltd or its subsidiaries)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [327392 2012-01-14] ()

==================== Drivers (Whitelisted) ====================

S3 ampa; C:\Windows\system32\ampa.sys [15288 2011-12-26] ()
S3 ampa; C:\Windows\SysWOW64\ampa.sys [12728 2011-12-26] ()
S1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 cmntnet; C:\Windows\System32\DRIVERS\cmntnet.sys [141824 2013-02-13] (Wireless Data Device)
S3 cmnuusbser; C:\Windows\System32\DRIVERS\cmnuusbser.sys [123904 2013-02-13] (Wireless Device)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-11-24] ()
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U0 dmboot;
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S2 VBoxDRV; \??\O:\VirtualBox\Portable-VirtualBox\app64\drivers\VBoxDrv\VBoxDrv.sys [X]
S2 VBoxUSBMon; \??\O:\VirtualBox\Portable-VirtualBox\app64\drivers\USB\filter\VBoxUSBMon.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-20 14:42 - 2014-02-20 14:43 - 02153472 _____ (Farbar) C:\Users\H1234\Downloads\FRST64 (1).exe
2014-02-20 14:38 - 2014-02-20 14:38 - 00000780 _____ () C:\Users\H1234\Desktop\JRT.txt
2014-02-20 14:22 - 2014-02-20 14:22 - 01037734 _____ (Thisisu) C:\Users\H1234S\Downloads\JRT (1).exe
2014-02-20 14:07 - 2014-02-20 14:07 - 00006805 _____ () C:\Users\H1234\Desktop\AdwCleaner[R2].txt
2014-02-20 13:32 - 2014-02-20 13:32 - 01241834 _____ () C:\Users\H1234S\Downloads\adwcleaner.exe
2014-02-20 10:43 - 2014-02-20 10:56 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-20 10:43 - 2014-02-20 10:43 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-20 10:41 - 2014-02-20 10:56 - 00000000 ____D () C:\Users\H1234\Desktop\mbar
2014-02-20 10:41 - 2014-02-20 10:41 - 12589848 _____ (Malwarebytes Corp.) C:\Users\H1234S\Downloads\mbar-1.07.0.1009.exe
2014-02-20 10:41 - 2014-02-20 10:41 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-20 07:47 - 2014-02-20 13:26 - 00000388 _____ () C:\Windows\Tasks\HPCeeScheduleForH1234.job
2014-02-20 07:47 - 2014-02-20 07:47 - 00003270 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForH1234
2014-02-20 07:41 - 2014-02-20 07:58 - 00052487 _____ () C:\Users\H1234\Downloads\Addition.txt
2014-02-20 07:40 - 2014-02-20 14:44 - 00000000 ____D () C:\FRST
2014-02-20 07:40 - 2014-02-20 14:44 - 00000000 _____ () C:\Users\H1234\Downloads\FRST.txt
2014-02-20 07:39 - 2014-02-20 07:39 - 02153472 _____ (Farbar) C:\Users\H1234\Downloads\FRST64.exe
2014-02-18 21:57 - 2014-02-18 21:57 - 00000887 _____ () C:\Users\Public\Desktop\osu!.lnk
2014-02-16 21:35 - 2014-02-16 21:35 - 00023912 _____ () C:\Users\H1234\Desktop\Plue_eating_candy.jpeg
2014-02-16 21:33 - 2014-02-16 21:33 - 00016050 _____ () C:\Users\H1234\Downloads\imgres.htm
2014-02-16 21:17 - 2014-02-16 21:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-16 20:22 - 2014-02-19 22:38 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-02-16 19:54 - 2014-02-16 20:11 - 56952904 _____ (ppy Pty. Ltd.) C:\Users\J123\Downloads\osu!install.exe
2014-02-12 17:00 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 17:00 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 17:00 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 17:00 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 17:00 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 17:00 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 17:00 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 17:00 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 17:00 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 17:00 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 17:00 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 17:00 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 17:00 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 17:00 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 17:00 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 17:00 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 17:00 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 17:00 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 17:00 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 17:00 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 17:00 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 17:00 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 17:00 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 17:00 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 17:00 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 17:00 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 17:00 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 17:00 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 17:00 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 17:00 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 17:00 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 17:00 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 17:00 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 17:00 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 17:00 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 17:00 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 17:00 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 17:00 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 17:00 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 17:00 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 17:00 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 15:13 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 15:13 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 15:13 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 15:13 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 15:13 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 15:13 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 15:12 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 15:12 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 15:12 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 15:12 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 15:12 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 15:12 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 15:12 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 15:12 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 15:12 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 15:12 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 15:12 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 15:12 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 15:12 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 15:12 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 15:12 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 15:12 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 15:12 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 15:12 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 15:12 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 14:04 - 2014-02-12 14:05 - 00002287 _____ () C:\Users\Public\Desktop\SteuerSparErklärung Selbstständige 2014.lnk
2014-02-12 14:04 - 2014-02-12 14:04 - 00000000 ____D () C:\Users\H1234\AppData\Local\AAV
2014-02-08 13:53 - 2014-02-08 13:53 - 00000000 ____D () C:\Users\H1234S\AppData\Local\Howler
2014-01-24 17:05 - 2014-01-24 17:05 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2014-02-20 14:44 - 2014-02-20 07:40 - 00000000 ____D () C:\FRST
2014-02-20 14:44 - 2014-02-20 07:40 - 00000000 _____ () C:\Users\H1234\Downloads\FRST.txt
2014-02-20 14:43 - 2014-02-20 14:42 - 02153472 _____ (Farbar) C:\Users\H1234\Downloads\FRST64 (1).exe
2014-02-20 14:38 - 2014-02-20 14:38 - 00000780 _____ () C:\Users\H1234\Desktop\JRT.txt
2014-02-20 14:22 - 2014-02-20 14:22 - 01037734 _____ (Thisisu) C:\Users\H1234S\Downloads\JRT (1).exe
2014-02-20 14:07 - 2014-02-20 14:07 - 00006805 _____ () C:\Users\H1234\Desktop\AdwCleaner[R2].txt
2014-02-20 14:04 - 2013-11-13 17:52 - 00000000 ____D () C:\AdwCleaner
2014-02-20 13:40 - 2012-05-03 11:39 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-20 13:34 - 2009-07-14 05:45 - 00030208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-20 13:34 - 2009-07-14 05:45 - 00030208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-20 13:32 - 2014-02-20 13:32 - 01241834 _____ () C:\Users\H1234S\Downloads\adwcleaner.exe
2014-02-20 13:31 - 2012-04-25 00:01 - 02093001 _____ () C:\Windows\WindowsUpdate.log
2014-02-20 13:30 - 2012-09-24 08:13 - 00003966 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{83436183-8D44-4503-BE81-03233892840E}
2014-02-20 13:28 - 2012-04-25 06:38 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-20 13:27 - 2012-10-19 07:40 - 00000000 ___RD () C:\Users\H1234S\Dropbox
2014-02-20 13:27 - 2012-10-19 07:38 - 00000000 ____D () C:\Users\H1234S\AppData\Roaming\Dropbox
2014-02-20 13:27 - 2012-05-03 11:39 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-20 13:26 - 2014-02-20 07:47 - 00000388 _____ () C:\Windows\Tasks\HPCeeScheduleForH1234.job
2014-02-20 13:26 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-20 13:26 - 2009-07-14 05:51 - 00019848 _____ () C:\Windows\setupact.log
2014-02-20 11:23 - 2013-04-12 22:20 - 00000432 _____ () C:\Windows\BRWMARK.INI
2014-02-20 10:56 - 2014-02-20 10:43 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-20 10:56 - 2014-02-20 10:41 - 00000000 ____D () C:\Users\H1234\Desktop\mbar
2014-02-20 10:43 - 2014-02-20 10:43 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-20 10:41 - 2014-02-20 10:41 - 12589848 _____ (Malwarebytes Corp.) C:\Users\H1234S\Downloads\mbar-1.07.0.1009.exe
2014-02-20 10:41 - 2014-02-20 10:41 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-20 09:25 - 2012-04-24 23:12 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-20 07:58 - 2014-02-20 07:41 - 00052487 _____ () C:\Users\H1234\Downloads\Addition.txt
2014-02-20 07:47 - 2014-02-20 07:47 - 00003270 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForH1234
2014-02-20 07:47 - 2013-01-31 15:39 - 00000000 ____D () C:\Users\H1234\AppData\Local\Hewlett-Packard
2014-02-20 07:47 - 2012-04-26 07:48 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-02-20 07:47 - 2011-11-24 04:03 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2014-02-20 07:45 - 2013-01-31 15:40 - 00000000 ____D () C:\Users\H1234\AppData\Roaming\HpUpdate
2014-02-20 07:45 - 2013-01-31 15:40 - 00000000 ____D () C:\Users\H1234\AppData\Roaming\HP Support Assistant
2014-02-20 07:39 - 2014-02-20 07:39 - 02153472 _____ (Farbar) C:\Users\H1234\Downloads\FRST64.exe
2014-02-20 07:38 - 2012-10-29 17:33 - 00003994 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4660930C-7526-42E5-9C1F-E778262B9B60}
2014-02-20 07:34 - 2011-11-24 04:16 - 00000000 ____D () C:\ProgramData\truesuite
2014-02-19 22:38 - 2014-02-16 20:22 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-02-19 19:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-18 22:32 - 2012-04-30 17:26 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{472CF516-9C5E-46F1-BEA9-9A9F2E7C6EB0}
2014-02-18 21:57 - 2014-02-18 21:57 - 00000887 _____ () C:\Users\Public\Desktop\osu!.lnk
2014-02-18 12:59 - 2013-05-30 21:48 - 00001079 _____ () C:\Users\H1234\Desktop\Traffic Travis v4.lnk
2014-02-18 12:54 - 2013-05-30 21:48 - 00000000 ____D () C:\Users\H1234\AppData\Roaming\Traffic Travis v4
2014-02-18 11:50 - 2012-04-25 00:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-18 11:34 - 2012-09-24 09:38 - 00000000 ____D () C:\Users\H1234S\AppData\Roaming\vlc
2014-02-16 21:35 - 2014-02-16 21:35 - 00023912 _____ () C:\Users\H1234\Desktop\Plue_eating_candy.jpeg
2014-02-16 21:33 - 2014-02-16 21:33 - 00016050 _____ () C:\Users\H1234\Downloads\imgres.htm
2014-02-16 21:17 - 2014-02-16 21:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-16 20:25 - 2012-10-29 17:33 - 00155048 _____ () C:\Users\H1234\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-16 20:15 - 2012-11-22 20:35 - 00000000 ____D () C:\Users\J123\AppData\Roaming\ICQ
2014-02-16 20:11 - 2014-02-16 19:54 - 56952904 _____ (ppy Pty. Ltd.) C:\Users\J123\Downloads\osu!install.exe
2014-02-16 19:53 - 2012-10-29 17:32 - 00000000 ____D () C:\Users\H1234
2014-02-16 18:40 - 2013-08-14 22:48 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-16 18:40 - 2012-04-25 06:41 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-16 17:48 - 2013-10-08 09:47 - 00000983 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-02-16 17:35 - 2012-05-03 11:39 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-16 17:35 - 2012-05-03 11:39 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-12 22:01 - 2012-05-04 21:24 - 00000000 ____D () C:\Users\J123\AppData\Roaming\Skype
2014-02-12 19:51 - 2012-04-30 17:54 - 00155048 _____ () C:\Users\J123\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-12 19:49 - 2009-07-14 05:45 - 05122904 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-12 17:05 - 2013-07-26 07:33 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-12 17:02 - 2011-11-24 03:47 - 00701310 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 17:02 - 2011-11-24 03:47 - 00150210 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 17:02 - 2011-02-11 18:15 - 01597700 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 17:02 - 2009-07-14 06:13 - 01597700 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 14:07 - 2012-09-24 08:14 - 00155048 _____ () C:\Users\H1234S\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-12 14:05 - 2014-02-12 14:04 - 00002287 _____ () C:\Users\Public\Desktop\SteuerSparErklärung Selbstständige 2014.lnk
2014-02-12 14:04 - 2014-02-12 14:04 - 00000000 ____D () C:\Users\H1234\AppData\Local\AAV
2014-02-12 14:01 - 2012-04-25 07:44 - 00000000 ____D () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft
2014-02-08 13:53 - 2014-02-08 13:53 - 00000000 ____D () C:\Users\H1234S\AppData\Local\Howler
2014-02-08 13:50 - 2012-04-26 07:41 - 00000000 ____D () C:\Program Files (x86)\EPSON Software
2014-02-08 13:50 - 2010-11-21 04:47 - 00969218 _____ () C:\Windows\PFRO.log
2014-02-08 13:48 - 2012-04-26 07:41 - 00000000 ____D () C:\Program Files (x86)\epson
2014-02-08 13:48 - 2011-11-24 04:03 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-08 13:46 - 2012-05-07 14:30 - 00000000 ____D () C:\ProgramData\Lexware
2014-02-08 13:46 - 2012-05-07 14:30 - 00000000 ____D () C:\Program Files (x86)\Lexware
2014-02-08 13:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help
2014-02-08 13:40 - 2012-10-30 16:54 - 00000000 ____D () C:\Users\H1234S\AppData\Local\LogMeIn Hamachi
2014-02-08 12:28 - 2013-05-16 08:28 - 05556104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-08 12:28 - 2012-04-25 06:38 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-08 12:28 - 2012-04-25 06:38 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-08 12:28 - 2011-11-24 04:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-06 13:16 - 2014-02-12 17:00 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 17:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 17:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 17:00 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 17:00 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 17:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 17:00 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 17:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 17:00 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 17:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 17:00 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 17:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 17:00 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 17:00 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 17:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 17:00 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 17:00 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 17:00 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 17:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 17:00 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 17:00 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 17:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 17:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 17:00 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 17:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 17:00 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 17:00 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 17:00 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 17:00 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 17:00 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 17:00 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 17:00 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 17:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 17:00 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 17:00 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 17:00 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 17:00 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 17:00 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 17:00 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-04 11:35 - 2012-10-16 16:22 - 00000000 ____D () C:\Users\H1234S\Documents\Steuerfälle
2014-02-04 09:35 - 2012-05-03 11:40 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-02-03 15:59 - 2012-10-30 17:07 - 00001056 _____ () C:\Users\H1234S\Desktop\Traffic Travis v4.lnk
2014-02-03 15:59 - 2012-10-30 17:07 - 00000000 ____D () C:\Users\H1234S\AppData\Roaming\Traffic Travis v4
2014-02-03 15:59 - 2012-10-30 17:07 - 00000000 ____D () C:\Users\H1234S\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Traffic Travis v4
2014-01-26 21:29 - 2012-10-29 23:29 - 00000000 ____D () C:\Users\J123\AppData\Local\LogMeIn Hamachi
2014-01-25 10:22 - 2012-09-24 08:16 - 00000000 ____D () C:\Users\H1234S\AppData\Local\Mozilla
2014-01-24 17:05 - 2014-01-24 17:05 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-24 17:05 - 2014-01-24 17:05 - 00000000 ____D () C:\Program Files\iPod
2014-01-24 17:05 - 2013-01-01 01:12 - 00000000 ____D () C:\Program Files\iTunes
2014-01-24 17:05 - 2012-06-22 15:39 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-24 17:03 - 2012-05-05 16:59 - 00000000 ____D () C:\ProgramData\Apple

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-19 19:23

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2014
Ran by H1234 at 2014-02-20 14:49:39
Running from C:\Users\H1234\Downloads
Boot Mode: Safe Mode (with Networking)
==========================================================


==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

 Leawo iTransfer version  1.4.0.1106 (x32 Version: 1.4.0.1106 - )
7-Zip 9.20 (x32 Version:  - )
AAVUpdateManager (x32 Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.0.0 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe CreatePDF Desktop Printer (x32 Version: 12.4.1 - Adobe)
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated)
Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated) Hidden
Adobe Photoshop CS5 (x32 Version: 12.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122 - Adobe Systems, Inc.)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.3.133 - Adobe Systems, Inc)
Adobe SVG Viewer 3.0 (x32 Version:  3.0 - Adobe Systems, Inc.)
AFPL Ghostscript 8.54 (x32 Version:  - )
AFPL Ghostscript Fonts (x32 Version:  - )
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
Aiseesoft iTunes Backup Genius 2.1.2 (x32 Version: 2.1.2 - Aiseesoft Studio)
Ann Video Converter 4.5.0 (x32 Version: 4.5.0 - AnnVideo International LLC.)
AOMEI Partition Assistant Pro Edition 5.2 (x32 Version:  - Aomei Technology Co., Ltd.)
Apple Application Support (x32 Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Artensoft Photo Collage Maker (Version: 1.2 - Artensoft)
Audacity 2.0.2 (x32 Version: 2.0.2 - Audacity Team)
Audiograbber 1.83 SE  (x32 Version: 1.83 SE  - Audiograbber)
Audiograbber MP3-Plugin (x32 Version: 1.0 - AG)
AuthenTec TrueAPI (Version: 1.3.0.116 - AuthenTec, Inc.) Hidden
AVG 2014 (Version: 14.0.3705 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4335 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4335 - AVG Technologies)
AVS Update Manager 1.0 (x32 Version:  - Online Media Technologies Ltd.)
AVS Video Converter 8 (x32 Version:  - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (x32 Version:  - Online Media Technologies Ltd.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Benutzerhandbuch EPSON PX730 Series (x32 Version:  - )
Bing Bar (x32 Version: 7.3.124.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
BRAdmin Professional 3 (x32 Version: 3.50.0002 - Brother)
Brother MFL-Pro Suite MFC-9320CW (x32 Version: 2.0.1.0 - Brother Industries, Ltd.)
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Camfrog Video Chat 6.3 (x32 Version: 6.3.223 - Camshare Inc.)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
CleverPrint (x32 Version: 3.00 - Abelssoft GmbH)
ColorPicker Version 2.5 (x32 Version: 2.5 - Cronoxyd.de)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink PhotoDirector 3 (x32 Version: 3.0.3618 - CyberLink Corp.)
CyberLink PhotoDirector 3 (x32 Version: 3.0.3618 - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (x32 Version: 10.0.1.2925 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.1.2925 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DATEV Installation V.2.8 (x32 Version:  - )
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version:  - Microsoft)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison)
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DHTML Editing Component (x32 Version: 6.02.0001 - Microsoft Corporation)
Digimarc MediaBridge Reader (x32 Version:  - )
DreamTSman (x32 Version: 2.2.9 - 7soft (Reimar Barnstorf))
Druckerdeinstallation für EPSON PX730 Series (Version:  - SEIKO EPSON Corporation)
DYMO Label v.8 (x32 Version: 8.3.0.1242 - Sanford, L.P.)
Elevated Installer (x32 Version: 2.3.17.0 - Garmin Ltd or its subsidiaries) Hidden
eM Client (x32 Version: 3.5.12360.0 - SoftMaker Software GmbH) Hidden
Epson Download Navigator (x32 Version: 1.0.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Print CD (x32 Version: 2.05.00 - SEIKO EPSON CORPORATION)
EPSON Scan (x32 Version:  - Seiko Epson Corporation)
EpsonNet Print (x32 Version: 2.4j - SEIKO EPSON CORPORATION)
EverDesk Google Edition (x32 Version: 5.1.1 - EverEZ Systems Limited)
EverDesk Google Edition (x32 Version: 5.1.1 - EverEZ Systems Limited) Hidden
EVEREST Home Edition v2.20 (x32 Version: 2.20 - Lavalys Inc)
Exact Audio Copy 1.0beta3 (x32 Version: 1.0beta3 - Andre Wiethoff)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0 - )
FileStream Web Boomerang (x32 Version: 3.0 - FileStream, Inc.)
FlipBook Maker  3.6.3 (x32 Version: 3.6.3 - Kvisoft Co,. Ltd)
Free Video Converter V 3.1 (x32 Version: 3.1.0.0 - Koyote Soft)
Free YouTube to MP3 Converter version 3.12.2.430 (x32 Version: 3.12.2.430 - DVDVideoSoft Ltd.)
Garmin Communicator Plugin x64 (Version: 4.0.3 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 2.3.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 2.3.17.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin POI Loader (x32 Version: 2.5.3.0 - Garmin Ltd or its subsidiaries)
Garmin POI Loader (x32 Version: 2.7.3 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (x32 Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.2 (Version: 2.8.2 - The GIMP Team)
Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
GPL Ghostscript (x32 Version: 9.05 - Artifex Software Inc.)
Haali Media Splitter (x32 Version:  - )
HERMA Label Designer plus 1.1 (x32 Version: 1.00.0000 - HERMA GmbH)
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Games (x32 Version: 1.0.2.5 - WildTangent)
HP LinkUp (x32 Version: 2.01.028 - Hewlett-Packard)
HP Odometer (x32 Version: 2.10.0000 - Hewlett-Packard)
HP Setup (x32 Version: 8.7.4747.3786 - Hewlett-Packard Company)
HP Setup Manager (x32 Version: 1.1.13880.3792 - Hewlett-Packard Company)
HP SimplePass PE 2011 (x32 Version: 5.3.0.194 - Hewlett-Packard)
HP Support Assistant (x32 Version: 6.0.4.1 - Hewlett-Packard Company)
HP Support Information (x32 Version: 10.1.1000 - Hewlett-Packard)
HP Update (x32 Version: 5.003.001.001 - Hewlett-Packard)
HP Vision Hardware Diagnostics (Version: 2.9.0.0 - Hewlett-Packard)
iCloud (Version: 3.1.0.40 - Apple Inc.)
IDT Audio (x32 Version: 1.0.6346.0 - IDT)
ImgBurn (x32 Version: 2.5.8.0 - LIGHTNING UK!)
Inkscape 0.48.4 (x32 Version: 0.48.4 - )
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
iResizer 2.1 (x32 Version:  - teorex)
IrfanView (remove only) (x32 Version: 4.36 - Irfan Skiljan)
iTunes (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 25 (x32 Version: 7.0.250 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (x32 Version: 2.5.3925 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.3925 - CyberLink Corp.) Hidden
LAME v3.99.3 (for Windows) (x32 Version:  - )
LibreOffice 4.1.4.2 (x32 Version: 4.1.4.2 - The Document Foundation)
Light Developer v7.1, build 12452 (x32 Version:  - Stepok Image Lab.)
Logitech GamePanel Software 3.03.133 (Version: 3.03.133 - Logitech Inc.)
Magic Desktop (x32 Version: 3.0 - EasyBits Software AS)
MAGIX Screenshare (Version: 4.3.6.1987 - MAGIX AG) Hidden
MAGIX Screenshare (x32 Version: 4.3.6.1987 - MAGIX AG)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Market Samurai (x32 Version: 0.93.00 - Alliance Software Pty Ltd)
Market Samurai (x32 Version: 0.93.00 - Alliance Software Pty Ltd) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Mathematics (x32 Version: 4.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Pro Photo Tools (x32 Version: 2.2 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft XML Parser (x32 Version: 8.70.1104.04 - Microsoft Corporation) Hidden
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Mobile Partner (x32 Version: 11.300.05.03.40 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 27.0.1 (x86 de) (x32 Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (x32 Version: 27.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Netzwerkhandbuch EPSON PX730 Series (x32 Version:  - )
Nuclear Coffee - VideoGet (x32 Version: 2012 - Nuclear Coffee)
NVIDIA Grafiktreiber 296.28 (Version: 296.28 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.62.312 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.10.0514 (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 296.28 (Version: 296.28 - NVIDIA Corporation) Hidden
NVIDIA Update 1.7.12 (Version: 1.7.12 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.7.12 - NVIDIA Corporation) Hidden
OpenAL (x32 Version:  - )
OpenOffice.org 3.3 (x32 Version: 3.3.9567 - OpenOffice.org)
osu! (x32 Version: 0.0.0.0 - peppy)
PaperPort Image Printer 64-bit (Version: 1.00.0000 - Nuance Communications, Inc.)
PatchBeam (x32 Version: 1.10 - ConeXware, Inc.)
PDF Blender (x32 Version:  - )
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF Split And Merge Basic (Version: 2.2.2 - Andrea Vacondio)
PDFCreator (x32 Version: 1.6.2 - pdfforge)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PhotoMagic 1.0.0.0 (x32 Version:  - )
PhotoScape (x32 Version:  - )
Picture Cutout Guide 3.0.2 (Version: 3.0.2 - Tint Guide)
Pixelplan - Flow Architect Studio 3D (x32 Version:  - )
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime amd64 (Version: 1.3.0 - Microsoft Corporation)
POIbase 1.066 (x32 Version:  - POIbase)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Power2Go (x32 Version: 6.1.5331 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.5331 - CyberLink Corp.) Hidden
PowerArchiver 2012 (x32 Version: 13.01.04 - ConeXware, Inc.)
PowerArchiver 2012 (x32 Version: 13.01.04 - ConeXware, Inc.) Hidden
PresentationTube Recorder 1.0 (x32 Version: 1.0 - PresentationTube)
Project Dogwaffle Howler version 8.2 (x32 Version: 8.2 - Daniel Ritchie)
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
RealDownloader (x32 Version: 1.3.0 - RealNetworks, Inc.) Hidden
Reality Fusion GameCam SE (x32 Version:  - )
Reality Fusion VBall (x32 Version:  - )
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (x32 Version: 16.0.0 - RealNetworks)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Recovery Manager (x32 Version: 5.5.0.4320 - CyberLink Corp.) Hidden
Remote Graphics Receiver (x32 Version: 5.4.5 - Hewlett-Packard)
Retouch Pilot Free 3.5.3 (Version: 3.5.3 - Two Pilots)
Safari (x32 Version: 5.34.57.2 - Apple Inc.)
ScanSoft PaperPort 11 (x32 Version: 11.2.0000 - Nuance Communications, Inc.)
Scribus 1.4.2 (64bit) (Version: 1.4.2 - The Scribus Team)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Sketch Drawer (x32 Version: 1.3 - SoftOrbits)
Skype™ 6.3 (x32 Version: 6.3.107 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Snap.Do (x32 Version: 1.6.1.962 - ReSoft Ltd.) <==== ATTENTION
SoftMaker Office Professional 2012 (x32 Version: 12.0.2627 - SoftMaker Software GmbH)
Sothink Flash Menu (x32 Version: 1.2 - SourceTec Software Co., LTD)
Spybot - Search & Destroy (x32 Version: 2.1.20 - Safer-Networking Ltd.)
Steuer-Spar-Erklärung Selbstständige 2013 (x32 Version: 18.09 - Wolters Kluwer Deutschland GmbH)
SteuerSparErklärung Selbstständige 2014 (x32 Version: 19.04.49 - Akademische Arbeitsgemeinschaft)
SUPER © +Recorder.2013.55 (Mar 7, 2013) Version +Recorder.2013. (x32 Version: +Recorder.2013.55 - eRightSoft)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Tinypic 3.18 (x32 Version: Tinypic 3.18 - E. Fiedler)
Traffic Travis 4.1.0 (x32 Version:  - Affilorama Ltd.)
Ulead Photo Explorer 6.0 (x32 Version:  - )
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837583) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VideoLink Mail (x32 Version:  - )
VIP Access SDK (1.0.1.4)  (x32 Version: 1.0.1.4 - Symantec Inc.)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio 2008 x64 Redistributables (x32 Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.6 (x32 Version: 2.0.6 - VideoLAN)
Webocton - Scriptly 0.8.95.6 (x32 Version: 0.8.95.6 - Webocton)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows 7 USB/DVD Download Tool (x32 Version: 1.0.30 - Microsoft Corporation)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows XP Mode (Version: 1.3.7600.16422 - Microsoft Corporation)
WinPDFEditor V2.0.2 (x32 Version:  - hxxp://www.WinPDFEditor.com)
WinRAR 4.11 (64-Bit) (Version: 4.11.0 - win.rar GmbH)
WinX HD Video Converter Deluxe 5.0.2 (x32 Version:  - Digiarty Software, Inc.)
Wondershare DVD Creator(Build 2.6.5) (x32 Version:  - Wondershare)
wpclipper-9.0 (x32 Version:  - Paul Sherman)
XSManager (x32 Version: 3.0 - XSManager)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Restore Points  =========================

08-02-2014 12:40:42 Removed LogMeIn Hamachi
08-02-2014 12:43:55 Removed Drivers For Free.
08-02-2014 12:44:42 Removed Lexware büro easy 2011.
08-02-2014 12:45:45 Removed Lexware online banking.
08-02-2014 12:46:14 Removed Lexware Elster.
08-02-2014 12:46:42 Removed Lexware Abschreibungsrechner.
08-02-2014 12:47:08 Removed Lexware Info Service.
08-02-2014 12:47:37 Removed Epson Customer Research Participation
08-02-2014 12:48:16 Removed Epson Event Manager
12-02-2014 13:00:17 SteuerSparErklärung 2014 wurde installiert.
12-02-2014 15:59:41 Windows Update
16-02-2014 16:47:13 Installed AVG 2014
16-02-2014 17:39:55 Windows Update
18-02-2014 11:51:49 Removed osu!
18-02-2014 20:56:47 Installed osu!

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-04-29 17:16 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {009886B6-97D8-4819-887E-D66D865C2151} - \DealPlyLiveUpdateTaskMachineCore No Task File
Task: {0803C8B6-359F-4766-A8CC-598F4CB72D2F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-09] (Hewlett-Packard Company)
Task: {09C025DC-1EDB-4622-A3AE-AF9580046644} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {14E48B90-47D8-4F51-842A-45EA975E09EB} - System32\Tasks\HPCeeScheduleForH1234 => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {16BC65D7-DF3F-4E15-A320-B7BA7BE42E5A} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2928652112-3187983571-3213460233-1003 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {187AAD0D-A50E-4F4A-BD7E-C5097878CE9B} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-15] ()
Task: {1B1B242B-A851-4C72-81DD-25250697FA7E} - System32\Tasks\Lexware-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe
Task: {1E0C7D4C-BBB0-4CB6-BA1F-1D491AA5F3E1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1E308B19-504D-46D1-81A7-C3F3122408D9} - \TubeSaver-15-chromeinstaller No Task File
Task: {23712C79-B15D-4FE0-BD94-AB6165DBFE4D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {24EFA391-80A3-4455-8112-EF66CBB987BF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03] (Google Inc.)
Task: {28FC4BCE-C9B1-4DB6-A875-04186A121A7F} - System32\Tasks\ScanSoft Background Update => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {2A47C10E-A312-4298-A5A9-640B46CBCC3E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03] (Google Inc.)
Task: {2B15657D-0B53-497C-8798-272E69BBAEB0} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {3363272A-F4EA-4BB6-92A1-3FE9B14959B8} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2928652112-3187983571-3213460233-1003 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {376E6E75-9E3E-42A9-BEB9-4E2436F835A2} - \DSite No Task File
Task: {39FEC947-138B-4E8C-9038-CDA4E040DDE4} - \Scheduled Update for Ask Toolbar No Task File
Task: {3B527420-FA94-46BC-AFAD-16EAF74EA91E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-11-22] (Hewlett-Packard)
Task: {3BC59860-5DBD-4E10-A5DF-33D091672422} - \TubeSaver-15-firefoxinstaller No Task File
Task: {4797BED0-DF13-4ABA-9285-74BA470EF442} - System32\Tasks\{97E1175C-BC34-414B-9834-B9DE2D0A820B} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Photoshop CS2\Photoshop.exe
Task: {4BE87E9A-FD0A-427F-8149-E8D1F966B9A3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-08] (Adobe Systems Incorporated)
Task: {54C47C2B-C96B-4DDE-9071-E6059B3CF675} - System32\Tasks\Express DownloaderUpdate => C:\Program Files (x86)\ExpressDownloader\EDUpdater.exe [2012-09-22] (hxxp://www.express-downloader.com/)
Task: {55E0C8B9-BA09-4203-AC20-F34ACBCB23BE} - \QtraxPlayer No Task File
Task: {5F96D245-0808-4BC6-BE81-AD7DE4A41B0C} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2928652112-3187983571-3213460233-1007 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {600760F2-A5C9-44C3-B001-3A835505DE42} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => C:\Program Files (x86)\real\realplayer\update\realsched.exe [2013-01-19] (RealNetworks, Inc.)
Task: {634511CC-5E73-474B-9C2F-8616B2B2D4E4} - \TubeSaver-15-updater No Task File
Task: {635F0CAB-328F-43B4-A80C-376A151BBE97} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {7245C09E-1648-4BB6-BC26-98C3FA338EC0} - System32\Tasks\AdobeAAMUpdater-1.0-Hermann-HP-H1234 => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {87D6CC04-0EDF-47D9-8989-6D8BC7DD9506} - \Dealply No Task File
Task: {958F2F46-5BA8-4339-9596-FC74206BBD2F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-09] (Hewlett-Packard Company)
Task: {9A46BE73-2E73-41A7-AC16-801EF07FE87A} - System32\Tasks\{F053FDCF-DED6-443C-A58E-F71D405A8558} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Photoshop CS2\Photoshop.exe
Task: {9B057959-2F6B-443F-9174-868A4FCD56FD} - \TubeSaver-15-codedownloader No Task File
Task: {9C26816F-BE3B-4D1C-9305-F11FC47121C2} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation)
Task: {A67DB159-C275-49CE-9915-F70CDCBB7DD7} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2011-05-10] (Hewlett-Packard)
Task: {B2171DEC-7FF4-4F5B-9851-C97294F92EEA} - System32\Tasks\{A717C1A4-D630-48B4-B93B-95D353793221} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Acrobat 7.0\Acrobat\Acrobat.exe
Task: {B34D3985-F896-4E6B-B3F7-8B44E8A4E198} - \DealPlyLiveUpdateTaskMachineUA No Task File
Task: {B6222B17-E72E-4B38-8B45-82FFD657A894} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-09] (Hewlett-Packard Company)
Task: {B7D11A3B-CE29-4290-AEB0-9AD5A25E81A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-23] (Hewlett-Packard Company)
Task: {BCDCC6B1-94DE-49D1-93A3-07F44DB6A5EF} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2928652112-3187983571-3213460233-1007 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {BD56A2F1-01A0-4E41-BE65-53B0CD5706B4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {BFEBC060-ACB3-4DC9-BC10-5F658807C91D} - \TubeSaver-15-enabler No Task File
Task: {C16FE6B6-EB71-4B30-91C1-4E6B7488E74F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2013-02-19] (Hewlett-Packard)
Task: {C788A697-E0C5-4256-BD98-23DD2A51692C} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {CF2B586D-C10E-4AF9-8961-6314ABF24E50} - System32\Tasks\{CB3FEE66-FE65-4428-8EDE-D82C14271540} => C:\Program Files (x86)\AdobeCreative Suite 2\Adobe Acrobat 7.0\Acrobat\Acrobat.exe
Task: {E7EDDDFF-319B-499F-BAE1-618719E322CF} - System32\Tasks\SetupManager => C:\Program Files (x86)\Hewlett-Packard\Setup Manager\toaster.exe [2011-06-21] (Microsoft)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForH1234.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe

==================== Loaded Modules (whitelisted) =============

2012-06-13 07:57 - 2012-02-17 19:55 - 00166912 _____ () C:\Program Files\WinRAR\rarext32.dll
2013-07-20 11:46 - 2013-05-16 09:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-07-20 11:46 - 2013-05-16 09:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-02-04 09:35 - 2014-02-02 00:42 - 04055368 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll
2014-02-04 09:35 - 2014-02-02 00:42 - 00399688 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll
2014-02-04 09:35 - 2014-02-02 00:41 - 01634632 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ffmpegsumo.dll
2014-02-20 07:42 - 2014-02-20 07:42 - 13632904 _____ () C:\Users\H1234\AppData\Local\Google\Chrome\User Data\PepperFlash\12.0.0.70\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (02/20/2014 02:44:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:44:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:44:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:44:30 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:44:30 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:44:30 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:43:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:43:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:43:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (02/20/2014 02:43:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-04-29 18:12:21.588
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-04-29 18:12:21.557
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.678
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Hermann\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.663
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Hermann\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.616
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-04-25 00:30:03.600
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 12268.32 MB
Available physical RAM: 10597.14 MB
Total Pagefile: 24534.83 MB
Available Pagefile: 22922.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:926.94 GB) (Free:706.32 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:13.13 GB) (Free:1.58 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive j: (Datenpartition) (Fixed) (Total:922.84 GB) (Free:649.76 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 40DB00A1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=927 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=923 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=13 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus 20.02.2014 17:02
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
SearchScopes: HKLM-x32 - URL http://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - TopResultURLFallback http://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
SearchScopes: HKLM-x32 - TopResultURL http://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}
FF Extension: Bazaar Friend - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\addon@bazaarfriend.com [2013-08-12]
FF Extension: Real Summer Sale - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\realsummersale1@realsummersale.com [2013-09-18]
FF Extension: Bargain Workbench - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{8eaa2500-4118-4c33-9927-988702ba63bd} [2013-09-18]
FF Extension: Snap.Do  - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{d14aaada-f47b-4e88-80ec-62198918d1e8} [2013-06-29]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-02-20]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


hardyxy9 20.02.2014 17:12
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64)

Version: 18-02-2014
Ran by **** at 2014-02-20 17:09:36 Run:1
Running from C:\Users\H1234\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKLM-x32 - URL hxxp://search.chatzum.com/?

orig=DS&affid=62&cztbid=394286201&q={searchTerms} SearchScopes: HKLM-

x32 - TopResultURLFallback hxxp://search.chatzum.com/?

orig=DS&affid=62&cztbid=394286201&q={searchTerms} SearchScopes: HKLM-

x32 - TopResultURL hxxp://search.chatzum.com/?

orig=DS&affid=62&cztbid=394286201&q={searchTerms} FF Extension: Bazaar

Friend - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles

\qxs2ikp0.default\Extensions\addon@bazaarfriend.com [2013-08-12] FF

Extension: Real Summer Sale - C:\Users\H1234\AppData\Roaming\Mozilla

\Firefox\Profiles\qxs2ikp0.default\Extensions

\realsummersale1@realsummersale.com [2013-09-18] FF Extension: Bargain

Workbench - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles

\qxs2ikp0.default\Extensions\{8eaa2500-4118-4c33-9927-988702ba63bd}

[2013-09-18] FF Extension: Snap.Do - C:\Users\H1234\AppData\Roaming

\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{d14aaada-f47b-

4e88-80ec-62198918d1e8} [2013-06-29] FF Extension: TrueSuite Website

Logon - C:\Program Files (x86)\Mozilla Firefox\extensions

\websitelogon@truesuite.com [2014-02-20]
*****************

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\

\URL => Value deleted successfully.

==== End of Fixlog ====

cosinus 20.02.2014 23:55
Das ging mal völlig daneben. Wie genau hast du den Fixtext kopiert? doch nicht Zeile für Zeile?

hardyxy9 21.02.2014 00:02
hmm, Windows + R Taste funktioniert bei mir nicht; habe das Programm notepad geöffnet und den kopierten Text eingefügt ...

cosinus 21.02.2014 10:55
Hat mit der Tastankombination mal garnix zu tun, du hast den Text falsch kopiert
Tipp: auf den Button "alles auswählen" klicken damit er gesamte Text markiert wird, STRG+C zum kopieren, STRG+V zum Einfügen in notepad

cosinus 21.02.2014 10:55
Hat mit der Tastankombination mal garnix zu tun, du hast den Text falsch kopiert
Tipp: auf den Button "alles auswählen" klicken damit er gesamte Text markiert wird, STRG+C zum kopieren, STRG+V zum Einfügen in notepad

hardyxy9 25.02.2014 16:54
Ich versuchs nochmal.
Habe gesehen, dass meine für das Board hier geänderten User Namen H1234 hier drin stehen, das muss ich vermutlich für den Aufruf von Frst ändern..?

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-02-2014 01
Ran by H1234 at 2014-02-25 16:52:36 Run:2
Running from C:\Users\H1234\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKLM-x32 - URL hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms} SearchScopes: HKLM-x32 - TopResultURLFallback hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms}

SearchScopes: HKLM-x32 - TopResultURL hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=394286201&q={searchTerms} FF Extension: Bazaar Friend - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions

\addon@bazaarfriend.com [2013-08-12] FF Extension: Real Summer Sale - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\realsummersale1@realsummersale.com [2013-09-18] FF Extension: Bargain Workbench -

C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default\Extensions\{8eaa2500-4118-4c33-9927-988702ba63bd} [2013-09-18] FF Extension: Snap.Do - C:\Users\H1234\AppData\Roaming\Mozilla\Firefox\Profiles\qxs2ikp0.default

\Extensions\{d14aaada-f47b-4e88-80ec-62198918d1e8} [2013-06-29] FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2014-02-20]
*****************

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\URL => Unable to delete value

==== End of Fixlog ====

cosinus 25.02.2014 23:52
Liste der Anhänge anzeigen (Anzahl: 1)
Irgendwas läuft bei dir beim copy&paste einfach falsch. Nimm meine Fixlist.txt aus dem Anhang. Auf dem Desktop speichern, vorhandene Fixlist überschreiben und Fix mit FRST wiederholen


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:45 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131