Trojaner-Board - BKA/Gema Trojaner auf Internet-Seite erhalten

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - BKA/Gema Trojaner auf Internet-Seite erhalten (https://www.trojaner-board.de/151813-bka-gema-trojaner-internet-seite-erhalten.html)

BKA/Gema Trojaner auf Internet-Seite erhalten

Hallo, ich habe heute beim Surfen auch eine sog. Warnmeldung erhalten, und sollte 100 Euro zum Entsperren bezahlen. Mein Browser (Chrome) konnte ich mit dem TaskManager schließen.
Bis jetzt funktioniert auch alles soweit ich das beurteilen kann. Ich bin mir aber nicht sicher, ob ich mir doch evtl. etwas eingefangen habe.
Mein Virenscanner Norton 2014 hat bisher nichts gefunden.

Danke
Jochen

Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hallo, habe gerade noch zuvor einen Scan mit ADwCleaner gemacht.

Hier das Ergebnis:AdwCleaner Logfile:

Code:

# AdwCleaner v3.022 - Bericht erstellt am 31/03/2014 um 23:27:13

# Aktualisiert 13/03/2014 von Xplode

# Betriebssystem : Windows 8.1  (64 bits)

# Benutzername : Jochen - JOCHENNOTEBOOK

# Gestartet von : C:\Users\Jochen\Downloads\adwcleaner_3.022.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Program Files (x86)\GreenTree Applications

Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\APN PIP

Schlüssel Gelöscht : HKLM\Software\PIP
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16518
 
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [1054 octets] - [31/03/2014 22:56:39]

AdwCleaner[S0].txt - [929 octets] - [31/03/2014 23:27:13]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [988 octets] ##########

--- --- ---

adwCleaner ist kein Virenscanner. Die Frage war, ob es bisherige Funde gab - von Virenscannern (abgesehen von Norton) Außerdem vermisse ich die FRST Logs.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Jochen (administrator) on JOCHENNOTEBOOK on 31-03-2014 23:44:29

Running from C:\Users\Jochen\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe

() C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe

(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe

() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe

() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

() C:\ProgramData\MobileBrServ\mbbservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe

(Microsoft Corporation) C:\Windows\System32\skydrive.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe

(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\WORDPAD.EXE

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.)

HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated)

HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805}

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.)

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" 
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com

SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = 

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)

BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

Chrome: 

=======

CHR HomePage: 

CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll ()

CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09]

CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09]

CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09]

CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09]

CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24]

CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]

CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24]
 

==================== Services (Whitelisted) =================
 

R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft)

R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd)

S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] ()

R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] ()

R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] ()

R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] ()

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] ()

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation                           )

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)

R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-03-31 23:44 - 2014-03-31 23:44 - 00020134 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-03-31 23:43 - 2014-03-31 23:44 - 00000000 ____D () C:\FRST

2014-03-31 23:42 - 2014-03-31 23:42 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 22:56 - 2014-03-31 23:27 - 00000000 ____D () C:\AdwCleaner

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-31 22:09 - 2014-03-31 22:10 - 02038479 _____ () C:\Users\Jochen\Downloads\Brushless_Control+T_DE_EN_FR.zip

2014-03-31 22:04 - 2014-03-31 22:04 - 00234449 _____ () C:\Users\Jochen\Downloads\33745_33760_33770_air3g_6s_1a26.zip

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS

2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll

2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll

2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys

2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe

2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll

2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll

2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys

2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll

2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll

2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll

2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll

2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll

2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll

2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll

2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll

2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll

2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log
 

==================== One Month Modified Files and Folders =======
 

2014-03-31 23:44 - 2014-03-31 23:44 - 00020134 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-03-31 23:44 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST

2014-03-31 23:44 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001

2014-03-31 23:42 - 2014-03-31 23:42 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-03-31 23:39 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat

2014-03-31 23:39 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat

2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-03-31 23:36 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8}

2014-03-31 23:36 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive

2014-03-31 23:36 - 2013-11-17 20:22 - 01964422 _____ () C:\WINDOWS\WindowsUpdate.log

2014-03-31 23:35 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job

2014-03-31 23:34 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job

2014-03-31 23:34 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI

2014-03-31 23:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2014-03-31 23:27 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner

2014-03-31 23:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job

2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 23:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton

2014-03-31 22:10 - 2014-03-31 22:09 - 02038479 _____ () C:\Users\Jochen\Downloads\Brushless_Control+T_DE_EN_FR.zip

2014-03-31 22:04 - 2014-03-31 22:04 - 00234449 _____ () C:\Users\Jochen\Downloads\33745_33760_33770_air3g_6s_1a26.zip

2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat

2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db

2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk

2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company

2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak

2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak

2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log

2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2014-03-01 08:05 - 2014-03-13 23:36 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2014-03-01 06:58 - 2014-03-13 23:36 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2014-03-01 06:30 - 2014-03-13 23:36 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2014-03-01 06:17 - 2014-03-13 23:36 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2014-03-01 05:54 - 2014-03-13 23:36 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2014-03-01 05:47 - 2014-03-13 23:36 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2014-03-01 05:42 - 2014-03-13 23:36 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2014-03-01 05:18 - 2014-03-13 23:36 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2014-03-01 05:14 - 2014-03-13 23:36 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2014-03-01 05:10 - 2014-03-13 23:36 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2014-03-01 05:03 - 2014-03-13 23:36 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2014-03-01 04:57 - 2014-03-13 23:36 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2014-03-01 04:38 - 2014-03-13 23:36 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2014-03-01 04:32 - 2014-03-13 23:36 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2014-03-01 04:27 - 2014-03-13 23:36 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2014-03-01 04:25 - 2014-03-13 23:36 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2014-03-01 04:25 - 2014-03-13 23:36 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
 

Some content of TEMP:

====================

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll

C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys

[2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02
 
 
 

LastRegBack: 2014-03-24 16:09
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014

Ran by Jochen at 2014-03-31 23:45:06

Running from C:\Users\Jochen\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}

AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
 

==================== Installed Programs ======================
 

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)

Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden

ANNO 1404 - Königsedition (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 3.10.0000 - Ubisoft)

ANNO 1503 GOLD (HKLM-x32\...\{DB833EF9-A198-49BE-970A-BD46F30BFBB4}) (Version: 1.05.00 - )

bavarianDEMON (HKLM-x32\...\{A6916452-1065-4F69-A8B0-96A7E0AEC999}) (Version: 6.31.0 - captron electronic GmbH)

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Canon iP4600 series Benutzerregistrierung (HKLM-x32\...\Canon iP4600 series Benutzerregistrierung) (Version:  - )

Canon iP4600 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4600_series) (Version:  - )

Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )

Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )

Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )

Castle Link (HKLM-x32\...\{D5C2DABD-6180-4F2F-82BA-AB2608D6BD19}) (Version: 3.56.05 - Castle Creations)

CD-LabelPrint (HKLM-x32\...\MediaNavigation.CDLabelPrint) (Version:  - )

Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Classic Shell (HKLM\...\{7F34ADBE-77C0-47A0-BBC6-B3DA16CE8E68}) (Version: 3.6.7 - IvoSoft)

Creative Centrale (HKLM-x32\...\Creative Centrale) (Version: 1.18.03 - Creative Technology Ltd.)

Creative Centrale (x32 Version: 1.18.03 - Creative Technology Ltd.) Hidden

Creative Software Update (x32 Version: 1.03.01 - Creative Technology Ltd.) Hidden

Creative ZEN Style Series Dokumentation (HKLM-x32\...\ZENSTYLESERIESUG) (Version:  - Creative Technology Ltd.)

Digital Copy (HKLM-x32\...\Digital Copy) (Version:  - )

Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden

Glary Utilities 4.0 (HKLM-x32\...\Glary Utilities 4) (Version: 4.0.0.50 - Glarysoft Ltd)

Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)

HiSuite (HKLM-x32\...\Hi Suite) (Version: 32.610.20.00.06 - Huawei Technologies Co.,Ltd)

Inkjet Printer/Scanner Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version:  - )

Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden

Java 7 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417017FF}) (Version: 7.0.170 - Oracle)

Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4420.1017 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd)

Nero 12 Essentials Toshiba (HKLM-x32\...\{BA8958DC-ADD7-41E5-8436-5883C7E871C7}) (Version: 12.0.00400 - Nero AG)

Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden

Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.2.0.38 - Symantec Corporation)

OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden

PhoenixRC (HKLM-x32\...\{7A03BEDC-6390-440E-8D13-721A22F0BD1F}) (Version: 3.00.12 - Ihr Firmenname)

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Premium Sound HD (HKLM\...\{94F03B8E-CB73-4653-AFE9-79112C01FED2}) (Version: 1.12.4600 - SRS Labs, Inc.)

PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden

Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden

PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)

Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version:  - )

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6738 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.3 - Synaptics Incorporated)

TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.0007.00002 - Toshiba Corporation)

TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)

TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425 - Toshiba Corporation)

TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)

Toshiba Password Utility (HKLM-x32\...\InstallShield_{6D35FF17-A8B3-43D3-917E-5A1F2C3FB628}) (Version: 2.00.910 - Toshiba Corporation)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden

TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)

Toshiba Places Icon Utility (HKLM\...\{C991A8C4-307C-4FDD-8AAE-A1BF44881E95}) (Version: 2.1.1 - TOSHIBA)

TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)

TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)

TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0012 - Toshiba Corporation)

TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)

Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.5.0 - Toshiba Europe GmbH)

TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden

Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden

WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.3.0 - WildTangent)

WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden

Windows Driver Package - Silicon Laboratories (silabenm) Ports  (10/05/2012 6.6.0.0) (HKLM\...\5118100F6945E20FB40C6DEA7D3D348AFD9E43D7) (Version: 10/05/2012 6.6.0.0 - Silicon Laboratories)

Windows-Treiberpaket - captron electronic GmbH CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\3C146DB26794293E02F5A5C8DC3DD9D0525039F2) (Version: 10/22/2009 2.06.00 - captron electronic GmbH)

YTD Video Downloader 4.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.1 - GreenTree Applications SRL)
 

==================== Restore Points  =========================
 

21-02-2014 11:44:27 Windows Update

18-03-2014 16:22:13 Windows Update

24-03-2014 12:43:50 Removed BRAIN
 

==================== Hosts content: ==========================
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {03B751AF-7831-44CB-A13B-FCFF4A8560B3} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-18] (Toshiba Europe GmbH)

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {2595AA48-1B94-4C39-ACBB-0405AC56F018} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {5C6724F8-77CB-40E8-8CE5-D1A3EA02EB1B} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-28] (TOSHIBA Corporation)

Task: {63F9EBAE-3CFA-4E30-BD55-A1004CA23A4C} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6CDEF921-5167-43E9-A11B-5AA5B55F5341} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {70620B4F-1F0A-482C-8B19-BDB0177600CE} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8A12E7E6-355A-4E02-AFA4-5CAED4C2B9A9} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-02-04] (Microsoft Corporation)

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {91FE3CA7-951A-432E-9D17-1F269DE8D83E} - System32\Tasks\SoftwareUpdateGU3 => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe

Task: {9DD1E390-D212-4E4D-85F6-6A34B345597B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.)

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {A8932318-36BF-4119-867E-D0E08EAD503B} - System32\Tasks\GlaryInitialize 4 => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe [2013-11-18] (Glarysoft Ltd)

Task: {ABE9EA28-EE73-47AD-B684-E37B40D88E8E} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\WSCStub.exe [2014-03-12] (Symantec Corporation)

Task: {B9E8ED11-21F5-4A6E-A014-CBF8B81D20B7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.)

Task: {C399CE48-FB6D-4EB5-8B94-838E582F83DE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {C41D1328-1DB2-4031-A2A8-A2F45DDF2BFC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {CA6E1AE1-FF1B-4C9F-829E-75B25F71E935} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E2C2B81A-7E8E-4C30-81D3-7B68A51C136F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {E2E9AB63-9714-4435-A6C9-4A44C419F1A2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-14] (Adobe Systems Incorporated)

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {EB72F876-1E0C-4465-BABC-FE55FD534A7C} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\GlaryInitialize 4.job => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\SoftwareUpdateGU3.job => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe

Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-10-14 00:38 - 2011-10-14 00:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

2013-08-04 19:20 - 2013-07-11 16:50 - 00137024 _____ () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe

2013-08-04 19:20 - 2013-05-02 04:15 - 00197632 _____ () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe

2013-03-10 16:39 - 2008-01-22 19:35 - 00103808 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

2013-03-18 20:00 - 2012-03-12 11:05 - 00232288 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe

2012-07-19 04:38 - 2012-07-19 04:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll

2012-07-19 04:38 - 2012-07-19 04:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll

2012-08-14 05:13 - 2012-08-14 05:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll

2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-07-31 09:11 - 2012-07-31 09:11 - 00024576 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll

2013-11-18 11:54 - 2013-11-18 11:54 - 00080160 _____ () C:\Program Files (x86)\Glarysoft\Glary Utilities 4\zlib1.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00891392 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtNetwork4.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 02281984 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtCore4.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00016896 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\featureController.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\osEvents.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00322048 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\log4cplus.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00339456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtXml4.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00400384 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\sqlite3.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00195584 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\libgsoap.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00062464 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\zlib1.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00446976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\deviceProfile.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00019456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\eventsSender.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\serviceManagerStarter.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00051016 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00716616 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libglesv2.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00100168 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libegl.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 04061000 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00394568 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 01647432 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll

2012-11-27 15:16 - 2012-06-25 20:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2014-03-31 23:39 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-03-31 23:39 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-03-31 23:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-03-31 23:39 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-03-31 23:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 13637448 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\Users\Jochen\SkyDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (03/31/2014 11:29:43 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/31/2014 10:43:13 PM) (Source: Application Hang) (User: )

Description: Programm wwahost.exe, Version 6.3.9600.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1370
 

Startzeit: 01cf4d211a225124
 

Endzeit: 4294967295
 

Anwendungspfad: C:\WINDOWS\syswow64\wwahost.exe
 

Berichts-ID: 0e7097b3-b915-11e3-bed9-7054d249348e
 

Vollständiger Name des fehlerhaften Pakets: Microsoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5c
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
 

Error: (03/31/2014 10:23:33 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (03/27/2014 06:20:02 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: skydrive.exe, Version: 6.3.9600.16507, Zeitstempel: 0x52ce4d58

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0x00000000

Fehleroffset: 0x0000000000000000

ID des fehlerhaften Prozesses: 0x1fc0

Startzeit der fehlerhaften Anwendung: 0xskydrive.exe0

Pfad der fehlerhaften Anwendung: skydrive.exe1

Pfad des fehlerhaften Moduls: skydrive.exe2

Berichtskennung: skydrive.exe3

Vollständiger Name des fehlerhaften Pakets: skydrive.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: skydrive.exe5
 

Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag) (User: )

Description: Das Volume "TI30992300A (C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
 

Error: (03/24/2014 04:11:22 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/24/2014 04:09:47 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/24/2014 02:47:43 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 
 

System errors:

=============

Error: (03/31/2014 11:29:43 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%14001
 

Error: (03/31/2014 10:23:33 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%14001
 

Error: (03/31/2014 10:22:29 PM) (Source: Ntfs) (User: )

Description: Auf dem Volume "\\?\Volume{0e57c233-b6f4-4c75-bd98-bc62c6387e95}" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
 

Error: (03/31/2014 09:45:45 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/27/2014 06:10:34 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/26/2014 10:10:21 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/24/2014 02:47:43 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%14001
 

Error: (03/24/2014 02:43:26 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Software Protection" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Software Protection erreicht.
 
 

Microsoft Office Sessions:

=========================

Error: (03/31/2014 11:29:43 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
 

Error: (03/31/2014 10:43:13 PM) (Source: Application Hang)(User: )

Description: wwahost.exe6.3.9600.16431137001cf4d211a2251244294967295C:\WINDOWS\syswow64\wwahost.exe0e7097b3-b915-11e3-bed9-7054d249348eMicrosoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5cApp
 

Error: (03/31/2014 10:23:33 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
 

Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (03/27/2014 06:20:02 PM) (Source: Application Error)(User: )

Description: skydrive.exe6.3.9600.1650752ce4d58unknown0.0.0.0000000000000000000000000000000001fc001cf49d6b2f4a12fC:\Windows\System32\skydrive.exeunknowna5cbdbef-b5cb-11e3-bed8-7054d249348e
 

Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag)(User: )

Description: TI30992300A (C:)Falscher Parameter. (0x80070057)
 

Error: (03/24/2014 04:11:22 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe
 

Error: (03/24/2014 04:09:47 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe
 

Error: (03/24/2014 02:47:43 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-03-24 07:08:24.000

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-24 07:08:23.938

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-24 07:08:23.938

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-24 07:08:22.547

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 22:29:57.725

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-18 22:21:15.061

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 22:20:37.609

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-18 22:20:19.686

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 22:18:22.712

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 19:01:30.703

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 29%

Total physical RAM: 6025.22 MB

Available physical RAM: 4265.98 MB

Total Pagefile: 6985.22 MB

Available Pagefile: 5135.19 MB

Total Virtual: 131072 MB

Available Virtual: 131071.79 MB
 

==================== Drives ================================
 

Drive c: (TI30992300A) (Fixed) (Total:687.83 GB) (Free:621.41 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 699 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Habe ich vorher mißverstanden. Ich habe nur Norton als Virenscaner. Auch das Norton Reparaturtool Power Eraser, was bei mir in Norton auch integriert ist und ausgewählt werden kann, hat keine Viren gefunden.

Schon ok, mach einfach mit den anderen Tools weiter.

Code:

# AdwCleaner v3.022 - Bericht erstellt am 31/03/2014 um 23:58:23

# Aktualisiert 13/03/2014 von Xplode

# Betriebssystem : Windows 8.1  (64 bits)

# Benutzername : Jochen - JOCHENNOTEBOOK

# Gestartet von : C:\Users\Jochen\Downloads\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16518
 
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [1054 octets] - [31/03/2014 22:56:39]

AdwCleaner[R1].txt - [889 octets] - [31/03/2014 23:57:39]

AdwCleaner[S0].txt - [1067 octets] - [31/03/2014 23:27:13]

AdwCleaner[S1].txt - [811 octets] - [31/03/2014 23:58:23]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [870 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.3 (03.23.2014:1)

OS: Windows 8.1 x64

Ran by Jochen on 01.04.2014 at  0:09:19,49

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Failed to delete: [Folder] "C:\ProgramData\ytd video downloader"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 01.04.2014 at  0:14:05,02

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hm richtig, adwCleaner hast ja schon vorher ausgeführt, aber JRT auch schon?

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Jochen (administrator) on JOCHENNOTEBOOK on 01-04-2014 00:19:52

Running from C:\Users\Jochen\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe

(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe

() C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe

() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

() C:\ProgramData\MobileBrServ\mbbservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(Microsoft Corporation) C:\Windows\System32\skydrive.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe

(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\WORDPAD.EXE

(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.)

HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated)

HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805}

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.)

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" 
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com

SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = 

SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = 

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)

BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

Chrome: 

=======

CHR HomePage: 

CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll ()

CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09]

CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09]

CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09]

CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09]

CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24]

CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]

CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24]
 

==================== Services (Whitelisted) =================
 

R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft)

R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd)

S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] ()

R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] ()

R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] ()

R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] ()

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] ()

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation                           )

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)

R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-04-01 00:19 - 2014-04-01 00:19 - 00020127 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt

2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe

2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe

2014-03-31 23:43 - 2014-04-01 00:18 - 00000000 ____D () C:\FRST

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 22:56 - 2014-03-31 23:58 - 00000000 ____D () C:\AdwCleaner

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS

2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll

2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll

2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys

2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe

2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll

2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll

2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys

2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll

2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll

2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll

2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll

2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll

2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll

2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll

2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll

2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll

2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log
 

==================== One Month Modified Files and Folders =======
 

2014-04-01 00:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job

2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-04-01 00:19 - 2014-04-01 00:19 - 00020127 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-04-01 00:19 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST

2014-04-01 00:15 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001

2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt

2014-04-01 00:14 - 2013-11-17 20:22 - 01361935 _____ () C:\WINDOWS\WindowsUpdate.log

2014-04-01 00:10 - 2013-06-12 19:43 - 00000000 ____D () C:\ProgramData\YTD Video Downloader

2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe

2014-04-01 00:08 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8}

2014-04-01 00:06 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-04-01 00:06 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat

2014-04-01 00:06 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat

2014-04-01 00:01 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive

2014-04-01 00:00 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job

2014-04-01 00:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-03-31 23:59 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job

2014-03-31 23:59 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-03-31 23:58 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner

2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI

2014-03-31 23:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton

2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat

2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db

2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk

2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company

2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak

2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak

2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log

2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
 

Some content of TEMP:

====================

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll

C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys

[2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02
 
 
 

LastRegBack: 2014-03-24 16:09
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Nach dem letzen Scan mit dem FRST Tool hat sich nur ein Fenster mit der FRST Logdatei geöffnet. Eine Addition Datei wurde nicht geöffnet.

Was ist mit meiner Frage zu JRT?
FRST erstellt nur eine additions.txt wenn ein Haken entsprechend gesetzt ist. Ab dem 2. Scan mit FRST musst du selbst den Haken setzen.

JRT habe ich schon gepostet um 00:15 Uhr.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Jochen (administrator) on JOCHENNOTEBOOK on 01-04-2014 00:31:41

Running from C:\Users\Jochen\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe

(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe

() C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe

() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

() C:\ProgramData\MobileBrServ\mbbservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(Microsoft Corporation) C:\Windows\System32\skydrive.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe

(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe

(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.)

HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated)

HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805}

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.)

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" 
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com

SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = 

SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = 

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)

BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

Chrome: 

=======

CHR HomePage: 

CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll ()

CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09]

CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09]

CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09]

CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09]

CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24]

CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]

CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24]
 

==================== Services (Whitelisted) =================
 

R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft)

R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd)

S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] ()

R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] ()

R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] ()

R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] ()

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] ()

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation                           )

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)

R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-01 00:19 - 2014-04-01 00:31 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt

2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe

2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe

2014-03-31 23:43 - 2014-04-01 00:31 - 00000000 ____D () C:\FRST

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 22:56 - 2014-03-31 23:58 - 00000000 ____D () C:\AdwCleaner

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS

2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll

2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll

2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys

2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe

2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll

2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll

2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys

2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll

2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll

2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll

2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll

2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll

2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll

2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll

2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll

2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll

2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log
 

==================== One Month Modified Files and Folders =======
 

2014-04-01 00:31 - 2014-04-01 00:19 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-04-01 00:31 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST

2014-04-01 00:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-04-01 00:24 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8}

2014-04-01 00:20 - 2013-11-17 20:22 - 01384775 _____ () C:\WINDOWS\WindowsUpdate.log

2014-04-01 00:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job

2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-04-01 00:15 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001

2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt

2014-04-01 00:10 - 2013-06-12 19:43 - 00000000 ____D () C:\ProgramData\YTD Video Downloader

2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe

2014-04-01 00:06 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-04-01 00:06 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat

2014-04-01 00:06 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat

2014-04-01 00:01 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive

2014-04-01 00:00 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job

2014-04-01 00:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-03-31 23:59 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job

2014-03-31 23:59 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-03-31 23:58 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner

2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI

2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton

2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat

2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db

2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk

2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company

2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak

2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak

2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log

2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
 

Some content of TEMP:

====================

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll

C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys

[2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02
 
 
 

LastRegBack: 2014-03-24 16:09
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Zitat:

Zitat von cosinus (Beitrag 1277250)

Hm richtig, adwCleaner hast ja schon vorher ausgeführt, aber JRT auch schon?

Das hatte ich gefragt :D

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Jochen (administrator) on JOCHENNOTEBOOK on 01-04-2014 00:31:41

Running from C:\Users\Jochen\Downloads

Windows 8.1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe

(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe

() C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe

() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

() C:\ProgramData\MobileBrServ\mbbservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe

(Microsoft Corporation) C:\Windows\System32\skydrive.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe

(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe

(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe

(Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.)

HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated)

HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805}

HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.)

HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" 
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com

SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = 

SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = 

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)

BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

Chrome: 

=======

CHR HomePage: 

CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll ()

CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File

CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09]

CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09]

CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09]

CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09]

CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24]

CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]

CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24]
 

==================== Services (Whitelisted) =================
 

R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft)

R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd)

S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] ()

R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] ()

R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] ()

R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] ()

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] ()

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation                           )

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)

R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-01 00:19 - 2014-04-01 00:31 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt

2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe

2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe

2014-03-31 23:43 - 2014-04-01 00:31 - 00000000 ____D () C:\FRST

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 22:56 - 2014-03-31 23:58 - 00000000 ____D () C:\AdwCleaner

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys

2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys

2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS

2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll

2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll

2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll

2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll

2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll

2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll

2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll

2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll

2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll

2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll

2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys

2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe

2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll

2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll

2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys

2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll

2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll

2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll

2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll

2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll

2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll

2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll

2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll

2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE

2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll

2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll

2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll

2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll

2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml

2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll

2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll

2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll

2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll

2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log
 

==================== One Month Modified Files and Folders =======
 

2014-04-01 00:31 - 2014-04-01 00:19 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt

2014-04-01 00:31 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST

2014-04-01 00:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-04-01 00:24 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8}

2014-04-01 00:20 - 2013-11-17 20:22 - 01384775 _____ () C:\WINDOWS\WindowsUpdate.log

2014-04-01 00:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job

2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe

2014-04-01 00:15 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001

2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt

2014-04-01 00:10 - 2013-06-12 19:43 - 00000000 ____D () C:\ProgramData\YTD Video Downloader

2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe

2014-04-01 00:06 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-04-01 00:06 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat

2014-04-01 00:06 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat

2014-04-01 00:01 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive

2014-04-01 00:00 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job

2014-04-01 00:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-03-31 23:59 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job

2014-03-31 23:59 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-03-31 23:58 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner

2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe

2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini

2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log

2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt

2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI

2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe

2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE

2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security

2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration

2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64

2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton

2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages

2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps

2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db

2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk

2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB

2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec

2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF

2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS

2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT

2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk

2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat

2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender

2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender

2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db

2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk

2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company

2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak

2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak

2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log

2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
 

Some content of TEMP:

====================

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll

C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll

C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll

C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll

C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys

[2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02
 
 
 

LastRegBack: 2014-03-24 16:09
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014

Ran by Jochen at 2014-04-01 00:32:06

Running from C:\Users\Jochen\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}

AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
 

==================== Installed Programs ======================
 

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)

Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden

ANNO 1404 - Königsedition (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 3.10.0000 - Ubisoft)

ANNO 1503 GOLD (HKLM-x32\...\{DB833EF9-A198-49BE-970A-BD46F30BFBB4}) (Version: 1.05.00 - )

bavarianDEMON (HKLM-x32\...\{A6916452-1065-4F69-A8B0-96A7E0AEC999}) (Version: 6.31.0 - captron electronic GmbH)

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Canon iP4600 series Benutzerregistrierung (HKLM-x32\...\Canon iP4600 series Benutzerregistrierung) (Version:  - )

Canon iP4600 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4600_series) (Version:  - )

Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )

Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )

Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )

Castle Link (HKLM-x32\...\{D5C2DABD-6180-4F2F-82BA-AB2608D6BD19}) (Version: 3.56.05 - Castle Creations)

CD-LabelPrint (HKLM-x32\...\MediaNavigation.CDLabelPrint) (Version:  - )

Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Classic Shell (HKLM\...\{7F34ADBE-77C0-47A0-BBC6-B3DA16CE8E68}) (Version: 3.6.7 - IvoSoft)

Creative Centrale (HKLM-x32\...\Creative Centrale) (Version: 1.18.03 - Creative Technology Ltd.)

Creative Centrale (x32 Version: 1.18.03 - Creative Technology Ltd.) Hidden

Creative Software Update (x32 Version: 1.03.01 - Creative Technology Ltd.) Hidden

Creative ZEN Style Series Dokumentation (HKLM-x32\...\ZENSTYLESERIESUG) (Version:  - Creative Technology Ltd.)

Digital Copy (HKLM-x32\...\Digital Copy) (Version:  - )

Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden

Glary Utilities 4.0 (HKLM-x32\...\Glary Utilities 4) (Version: 4.0.0.50 - Glarysoft Ltd)

Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)

HiSuite (HKLM-x32\...\Hi Suite) (Version: 32.610.20.00.06 - Huawei Technologies Co.,Ltd)

Inkjet Printer/Scanner Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version:  - )

Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden

Java 7 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417017FF}) (Version: 7.0.170 - Oracle)

Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4420.1017 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd)

Nero 12 Essentials Toshiba (HKLM-x32\...\{BA8958DC-ADD7-41E5-8436-5883C7E871C7}) (Version: 12.0.00400 - Nero AG)

Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden

Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.2.0.38 - Symantec Corporation)

OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)

Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden

Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden

PhoenixRC (HKLM-x32\...\{7A03BEDC-6390-440E-8D13-721A22F0BD1F}) (Version: 3.00.12 - Ihr Firmenname)

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Premium Sound HD (HKLM\...\{94F03B8E-CB73-4653-AFE9-79112C01FED2}) (Version: 1.12.4600 - SRS Labs, Inc.)

PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden

Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden

PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)

Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version:  - )

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6738 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.3 - Synaptics Incorporated)

TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.0007.00002 - Toshiba Corporation)

TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)

TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425 - Toshiba Corporation)

TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)

Toshiba Password Utility (HKLM-x32\...\InstallShield_{6D35FF17-A8B3-43D3-917E-5A1F2C3FB628}) (Version: 2.00.910 - Toshiba Corporation)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden

TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)

Toshiba Places Icon Utility (HKLM\...\{C991A8C4-307C-4FDD-8AAE-A1BF44881E95}) (Version: 2.1.1 - TOSHIBA)

TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)

TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)

TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0012 - Toshiba Corporation)

TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)

Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.5.0 - Toshiba Europe GmbH)

TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden

Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden

WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.3.0 - WildTangent)

WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden

Windows Driver Package - Silicon Laboratories (silabenm) Ports  (10/05/2012 6.6.0.0) (HKLM\...\5118100F6945E20FB40C6DEA7D3D348AFD9E43D7) (Version: 10/05/2012 6.6.0.0 - Silicon Laboratories)

Windows-Treiberpaket - captron electronic GmbH CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\3C146DB26794293E02F5A5C8DC3DD9D0525039F2) (Version: 10/22/2009 2.06.00 - captron electronic GmbH)

YTD Video Downloader 4.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.1 - GreenTree Applications SRL)
 

==================== Restore Points  =========================
 

21-02-2014 11:44:27 Windows Update

18-03-2014 16:22:13 Windows Update

24-03-2014 12:43:50 Removed BRAIN
 

==================== Hosts content: ==========================
 

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {03B751AF-7831-44CB-A13B-FCFF4A8560B3} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-18] (Toshiba Europe GmbH)

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {2595AA48-1B94-4C39-ACBB-0405AC56F018} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {5C6724F8-77CB-40E8-8CE5-D1A3EA02EB1B} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-28] (TOSHIBA Corporation)

Task: {63F9EBAE-3CFA-4E30-BD55-A1004CA23A4C} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6CDEF921-5167-43E9-A11B-5AA5B55F5341} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {70620B4F-1F0A-482C-8B19-BDB0177600CE} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8A12E7E6-355A-4E02-AFA4-5CAED4C2B9A9} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-02-04] (Microsoft Corporation)

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {91FE3CA7-951A-432E-9D17-1F269DE8D83E} - System32\Tasks\SoftwareUpdateGU3 => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe

Task: {9DD1E390-D212-4E4D-85F6-6A34B345597B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.)

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {A8932318-36BF-4119-867E-D0E08EAD503B} - System32\Tasks\GlaryInitialize 4 => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe [2013-11-18] (Glarysoft Ltd)

Task: {ABE9EA28-EE73-47AD-B684-E37B40D88E8E} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\WSCStub.exe [2014-03-12] (Symantec Corporation)

Task: {B9E8ED11-21F5-4A6E-A014-CBF8B81D20B7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.)

Task: {C399CE48-FB6D-4EB5-8B94-838E582F83DE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation)

Task: {C41D1328-1DB2-4031-A2A8-A2F45DDF2BFC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)

Task: {CA6E1AE1-FF1B-4C9F-829E-75B25F71E935} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E2C2B81A-7E8E-4C30-81D3-7B68A51C136F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {E2E9AB63-9714-4435-A6C9-4A44C419F1A2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-14] (Adobe Systems Incorporated)

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {EB72F876-1E0C-4465-BABC-FE55FD534A7C} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\GlaryInitialize 4.job => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\SoftwareUpdateGU3.job => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe

Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-10-14 00:38 - 2011-10-14 00:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

2013-08-04 19:20 - 2013-07-11 16:50 - 00137024 _____ () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe

2013-08-04 19:20 - 2013-05-02 04:15 - 00197632 _____ () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe

2013-03-10 16:39 - 2008-01-22 19:35 - 00103808 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

2013-03-18 20:00 - 2012-03-12 11:05 - 00232288 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe

2012-07-19 04:38 - 2012-07-19 04:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll

2012-07-19 04:38 - 2012-07-19 04:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll

2012-08-14 05:13 - 2012-08-14 05:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll

2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-07-31 09:11 - 2012-07-31 09:11 - 00024576 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll

2013-11-18 11:54 - 2013-11-18 11:54 - 00080160 _____ () C:\Program Files (x86)\Glarysoft\Glary Utilities 4\zlib1.dll

2014-03-31 23:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-03-31 23:39 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-03-31 23:39 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-03-31 23:39 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-03-31 23:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00891392 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtNetwork4.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 02281984 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtCore4.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00016896 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\featureController.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\osEvents.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00322048 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\log4cplus.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00339456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtXml4.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00400384 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\sqlite3.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00195584 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\libgsoap.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00062464 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\zlib1.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00446976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\deviceProfile.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00019456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\eventsSender.dll

2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\serviceManagerStarter.dll

2012-11-27 15:16 - 2012-06-25 20:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00051016 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00716616 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libglesv2.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00100168 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libegl.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 04061000 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 00394568 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 01647432 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll

2014-03-18 19:34 - 2014-03-15 02:50 - 13637448 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\Users\Jochen\SkyDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (03/31/2014 11:29:43 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/31/2014 10:43:13 PM) (Source: Application Hang) (User: )

Description: Programm wwahost.exe, Version 6.3.9600.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1370
 

Startzeit: 01cf4d211a225124
 

Endzeit: 4294967295
 

Anwendungspfad: C:\WINDOWS\syswow64\wwahost.exe
 

Berichts-ID: 0e7097b3-b915-11e3-bed9-7054d249348e
 

Vollständiger Name des fehlerhaften Pakets: Microsoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5c
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
 

Error: (03/31/2014 10:23:33 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (03/27/2014 06:20:02 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: skydrive.exe, Version: 6.3.9600.16507, Zeitstempel: 0x52ce4d58

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0x00000000

Fehleroffset: 0x0000000000000000

ID des fehlerhaften Prozesses: 0x1fc0

Startzeit der fehlerhaften Anwendung: 0xskydrive.exe0

Pfad der fehlerhaften Anwendung: skydrive.exe1

Pfad des fehlerhaften Moduls: skydrive.exe2

Berichtskennung: skydrive.exe3

Vollständiger Name des fehlerhaften Pakets: skydrive.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: skydrive.exe5
 

Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005
 

Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag) (User: )

Description: Das Volume "TI30992300A (C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
 

Error: (03/24/2014 04:11:22 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/24/2014 04:09:47 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 

Error: (03/24/2014 02:47:43 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert.
 
 

System errors:

=============

Error: (03/31/2014 11:29:43 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%14001
 

Error: (03/31/2014 10:23:33 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%14001
 

Error: (03/31/2014 10:22:29 PM) (Source: Ntfs) (User: )

Description: Auf dem Volume "\\?\Volume{0e57c233-b6f4-4c75-bd98-bc62c6387e95}" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
 

Error: (03/31/2014 09:45:45 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/27/2014 06:10:34 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/26/2014 10:10:21 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/24/2014 02:47:43 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%14001
 

Error: (03/24/2014 02:43:26 PM) (Source: DCOM) (User: NT-AUTORITÄT)

Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Software Protection" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Software Protection erreicht.
 
 

Microsoft Office Sessions:

=========================

Error: (03/31/2014 11:29:43 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
 

Error: (03/31/2014 10:43:13 PM) (Source: Application Hang)(User: )

Description: wwahost.exe6.3.9600.16431137001cf4d211a2251244294967295C:\WINDOWS\syswow64\wwahost.exe0e7097b3-b915-11e3-bed9-7054d249348eMicrosoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5cApp
 

Error: (03/31/2014 10:23:33 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
 

Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (03/27/2014 06:20:02 PM) (Source: Application Error)(User: )

Description: skydrive.exe6.3.9600.1650752ce4d58unknown0.0.0.0000000000000000000000000000000001fc001cf49d6b2f4a12fC:\Windows\System32\skydrive.exeunknowna5cbdbef-b5cb-11e3-bed8-7054d249348e
 

Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program)(User: )

Description: 80070005
 

Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag)(User: )

Description: TI30992300A (C:)Falscher Parameter. (0x80070057)
 

Error: (03/24/2014 04:11:22 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe
 

Error: (03/24/2014 04:09:47 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe
 

Error: (03/24/2014 02:47:43 PM) (Source: SideBySide)(User: )

Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-03-24 07:08:24.000

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-24 07:08:23.938

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-24 07:08:23.938

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-24 07:08:22.547

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 22:29:57.725

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-18 22:21:15.061

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 22:20:37.609

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2014-03-18 22:20:19.686

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 22:18:22.712

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 

  Date: 2014-03-18 19:01:30.703

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 33%

Total physical RAM: 6025.22 MB

Available physical RAM: 3982.17 MB

Total Pagefile: 6985.22 MB

Available Pagefile: 4835.64 MB

Total Virtual: 131072 MB

Available Virtual: 131071.84 MB
 

==================== Drives ================================
 

Drive c: (TI30992300A) (Fixed) (Total:687.83 GB) (Free:621.29 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 699 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

JRT habe ich zuvor nicht gekannt und daher auch noch nicht ausgeführt.
Nur den adwcleaner