Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows XP, Firefox und Chrom sind voll mit Werbung die mit "Ads By RR" markiert ist (https://www.trojaner-board.de/153451-windows-xp-firefox-chrom-voll-werbung-ads-by-rr-markiert.html)

Nujakan 04.05.2014 23:34
Windows XP, Firefox und Chrom sind voll mit Werbung die mit "Ads By RR" markiert ist
 
Schönen guten Abend,

ich habe mir heute etwas eingefangen, was dafür sorgt, das ich in beiden von mir verwendeten Browsern (Chrom und Firefox) ohne erkennbares Muster Worte doppelt unterstrichen und mit Werbung verlinkt vorfinde. Es handelt sich dabei idR um zwei auf einander folgende Worte. Gelegentlich öffnen sich auch neue Taps mit Werbung, was glaube ich mit den eben beschrieben Worten zusammenhängt.
Die Worte sind blau unterstrichen.

Ich glaube das ich das ganze bekommen habe als ich Firefox und Java Updaten wollte. Das hat nebenbei eine ganze Reihe von Programmen auf meinem PC installiert und meine Tool-bares und Browser-Startseiten geändert. Das habe ich bisher gelöscht bzw wieder den von mir gewollten Zustand hergestellt. Der oben beschriebene Fehler ist mir erst danach aufgefallen, als ich den PC neu gestartet hatte.

Das Add-on "HTTPS Everywhere" (Vision vom 2014.4.25) schein auf den Seiten die es verschlüsselt den Effekt zu unterdrücken.
Auch scheinen Anwendungen außerhalb der Browser nicht betroffen (also etwa Spotify).

Bedauerlicher weise weiß ich wesentlich weniger über PCs als ich gerne würde. Aus den Infos dieser Seite habe ich bisher hergeleitet, das Logs benötigt werden, die gewisse Infos beinhalten. Ich hab das auch versucht, bin mir aber unsicher welche jetzt die Relevanten sind (bzw. ob ich die richtigen habe). Da ich ungerne einfach irgendwelche Daten die ich nicht verstehe veröffentliche würde ich ungern einfach irgendwas rein setzen (wobei ich einem Hilfsbereiten durchaus alles nötige zur Verfügung stellen würde).

Ich danke schon mal jedem der bis hierher gelesen hat und mir helfen möchte.
Mit freundlichen Grüßen,
Nujakan

PS: Wenn mehr Infos benötigt werden stelle ich die gerne zur Verfügung

schrauber 05.05.2014 06:50
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Nujakan 05.05.2014 09:46
Ich hoffe das sind die Daten die gebraucht werden.

FRST:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-05-2014
Ran by Justus (administrator) on JUSTUS-PC on 05-05-2014 10:34:33
Running from C:\Users\Justus\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\Program Files\ShrewSoft\VPN Client\iked.exe
(Realtek Semiconductor) C:\Windows\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
(Spotify Ltd) C:\Users\Justus\AppData\Roaming\Spotify\spotify.exe
(Spotify Ltd) C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Smartbar) C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Akamai Technologies, Inc.) C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\LPT\srpts.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Program Files\RrFilter\RrFilterService64.exe
() C:\Program Files\002\yewimmxqbs64.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Local\LPT\srptm.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6297088 2008-05-28] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252296 2012-01-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Aeria Ignite] => C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe [1925656 2013-06-06] (Aeria Games & Entertainment)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-04-15] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Google Update] => C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-03-24] (Google Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Spotify] => C:\Users\Justus\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-08] (Spotify Ltd)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Spotify Web Helper] => C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-08] (Spotify Ltd)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Browser Infrastructure Helper] => C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.exe [28192 2014-04-23] (Smartbar)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [GoogleChromeAutoLaunch_4B58CE89BFB61E88DC2FAC95911F6EFA] => C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\MountPoints2: {233aaba2-b816-11e2-9849-0008549fe9f1} - E:\Windows\CHECK\DriveNavigator.exe
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\MountPoints2: {7f9a167f-0fc1-11e3-9ef2-003067abfac7} - E:\autorun.exe
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll [1778584 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs:  C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll [1791384 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll [1236368 2012-03-12] (Bandoo Media, inc)
AppInit_DLLs-x32:  C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll => C:\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll [1233816 2012-03-12] (Bandoo Media, inc)
Startup: C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (No File)
Startup: C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKlugrdUkL8K3fEcj-YHWaciWXKB1ruyQPNOMcWumK5MjUsaf-Zso4,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B04_0sN-FcfwfHJm4YFhG_mRvjMpi7l1iUywgIjPBMMQtyYMHiUPTgQiT6DTpS_Y,
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEC025D046775CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKlugrdUkL8K3fEcj-YHWaciWXKB1ruyQPNOMcWumK5MjUsaf-Zso4,&q={searchTerms}
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=338&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=338&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKlugrdUkL8K3fEcj-YHWaciWXKB1ruyQPNOMcWumK5MjUsaf-Zso4,&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKlugrdUkL8K3fEcj-YHWaciWXKB1ruyQPNOMcWumK5MjUsaf-Zso4,&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKlugrdUkL8K3fEcj-YHWaciWXKB1ruyQPNOMcWumK5MjUsaf-Zso4,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKlugrdUkL8K3fEcj-YHWaciWXKB1ruyQPNOMcWumK5MjUsaf-Zso4,&q={searchTerms}
BHO: Shopping Helper SmartbarEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: RrSavings - {10AD2C61-0898-4348-8600-14A342F22AC3} - C:\Program Files (x86)\Rr Savings\RrSavings.dll ()
BHO-x32: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
BHO-x32: Shopping Helper SmartbarEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: ConstaSurf - {96cf2cbe-b6d5-454a-a62a-84bcda86ef1d} - C:\Program Files (x86)\ConstaSurf\ConstaSurfbho.dll (ConstaSurf)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\MP3 Skype Recorder\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{C8DC7B6B-C500-463E-ADEE-1A9B04422CE7}: [NameServer]132.252.3.10,132.252.1.7

FireFox:
========
FF ProfilePath: C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default
FF NewTab: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B1ZU_zZrqB5o2Ir8P03dcPuSilCBKsjTi4fhEFoFK7IvWbJvSduUN908an7LY2T8,
FF SearchEngineOrder.1: Search Results
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKlugrdUkL8K3fEcj-YHWaciWXKB1ruyQPNOMcWumK5MjUsaf-Zso4,&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @coreonline.com/run3d,version=1.0 - C:\Users\Justus\AppData\LocalLow\Square Enix\nprun3d.dll (Square Enix)
FF Plugin HKCU: @eximion.com/KalydoPlayer - C:\Users\Justus\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Justus\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Justus\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Justus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Zotero - C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\Extensions\zotero@chnm.gmu.edu [2012-08-07]
FF Extension: Searchqu Toolbar - C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\Extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} [2012-04-02]
FF Extension: NoScript - C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-09-29]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-04-11]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-01-12]

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR StartupUrls: "hxxp://www.spiegel.de/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Extension: (YouTube) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-24]
CHR Extension: (Adblock Plus) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-02-01]
CHR Extension: (Google-Suche) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-24]
CHR Extension: (HTTPS Everywhere) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2012-03-24]
CHR Extension: (AdBlock) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-03-20]
CHR Extension: (Zotero Connector) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\jciblakmllnhbhjjgkbkeihelcndmgnh [2012-04-10]
CHR Extension: (RrSavings) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\kofjjfgnmnjmoihhmjpafcllkhinmboe [2014-05-04]
CHR Extension: (Skype Click to Call) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-03-24]
CHR Extension: (Google Wallet) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Citavi Picker) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio [2014-01-12]
CHR Extension: (Google Mail) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-24]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-01-17]
CHR HKLM-x32\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx [2014-01-12]
CHR StartMenuInternet: Google Chrome - C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-04-18] (Perfect World Entertainment Inc)
R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] ()
R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-08] (LogMeIn, Inc.)
R2 LPTSystemUpdater; C:\Program Files (x86)\LPT\srpts.exe [37920 2014-04-23] ()
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-28] ()
R2 RrFilterService64; c:\Program Files\RrFilter\RrFilterService64.exe [171008 2014-03-06] ()
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [746392 2013-03-20] (Tunngle.net GmbH)
R2 yewimmxqbs64; C:\Program Files\002\yewimmxqbs64.exe [706560 2014-05-04] ()
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [X]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [X]

==================== Drivers (Whitelisted) ====================

R1 BIOS; C:\Windows\system32\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
R1 BIOS; C:\Windows\SysWOW64\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
S3 E100B; C:\Windows\System32\DRIVERS\efe5b32e.sys [192256 2009-06-10] (Intel Corporation)
S3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [61736 2014-02-28] (NetFilterSDK.com)
R3 rtl819xpn64; C:\Windows\System32\DRIVERS\rtl819xp.sys [570880 2009-05-18] (Realtek Semiconductor Corporation                          )
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Classic\safedrv.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-04 23:38 - 2014-05-04 23:39 - 00043810 _____ () C:\Users\Justus\Downloads\Addition.txt
2014-05-04 23:37 - 2014-05-05 10:34 - 00025789 _____ () C:\Users\Justus\Downloads\FRST.txt
2014-05-04 23:37 - 2014-05-05 10:34 - 00000000 ____D () C:\FRST
2014-05-04 23:36 - 2014-05-04 23:36 - 02062336 _____ (Farbar) C:\Users\Justus\Downloads\FRST64.exe
2014-05-04 23:00 - 2014-05-04 23:01 - 00000000 ____D () C:\Program Files\RrFilter
2014-05-04 23:00 - 2014-05-04 23:00 - 00000000 ____D () C:\Program Files (x86)\Rr Savings
2014-05-04 22:59 - 2014-05-04 22:59 - 00000000 ____D () C:\Program Files\rrsavings
2014-05-04 22:59 - 2014-05-04 22:59 - 00000000 ____D () C:\Program Files\002
2014-05-04 22:58 - 2014-05-04 23:16 - 00000286 _____ () C:\Windows\Tasks\RegClean Pro_UPDATES.job
2014-05-04 22:58 - 2014-05-04 23:16 - 00000278 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-05-04 22:58 - 2014-05-04 22:58 - 00003326 _____ () C:\Windows\System32\Tasks\Advanced System Protector
2014-05-04 22:58 - 2014-05-04 22:58 - 00003120 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-05-04 22:58 - 2014-05-04 22:58 - 00003032 _____ () C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2014-05-04 22:58 - 2014-05-04 22:58 - 00002876 _____ () C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\ProgramData\Systweak
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Program Files (x86)\ConstaSurf
2014-05-04 22:58 - 2012-07-25 12:03 - 00016896 _____ () C:\Windows\system32\sasnative64.exe
2014-05-04 22:57 - 2014-05-05 00:16 - 00000000 ____D () C:\Program Files (x86)\LPT
2014-05-04 22:57 - 2014-05-04 23:07 - 00002733 _____ () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-04 22:57 - 2014-05-04 22:58 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Systweak
2014-05-04 22:57 - 2014-05-04 22:57 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-05-04 22:55 - 2014-05-04 22:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Smartbar
2014-05-04 22:55 - 2014-05-04 22:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\LPT
2014-05-03 15:22 - 2014-04-29 18:00 - 23133184 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 15:22 - 2014-04-29 17:24 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 15:22 - 2014-04-29 16:47 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 15:22 - 2014-04-29 16:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-01 23:42 - 2014-05-01 23:48 - 00000000 ____D () C:\Users\Justus\Desktop\UF-Text
2014-04-28 23:12 - 2014-04-28 23:12 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard
2014-04-28 23:06 - 2014-04-28 23:12 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-28 23:06 - 2014-04-28 23:06 - 00001167 _____ () C:\Users\Public\Desktop\Hearthstone.lnk
2014-04-28 23:06 - 2014-04-28 23:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-04-28 22:43 - 2014-05-02 11:31 - 00000000 ____D () C:\Users\Justus\AppData\Local\Battle.net
2014-04-28 22:43 - 2014-05-02 11:30 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-28 22:43 - 2014-04-28 23:06 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00001130 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard Entertainment
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-04-28 22:40 - 2014-04-28 22:40 - 07094224 _____ (Blizzard Entertainment) C:\Users\Justus\Downloads\Hearthstone-Setup-deDE.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00000000 ____D () C:\ProgramData\Battle.net
2014-04-23 15:06 - 2014-04-28 14:01 - 00000000 ____D () C:\Users\Justus\Desktop\Stiendium
2014-04-23 12:30 - 2014-04-23 12:30 - 00316160 _____ (Dropbox, Inc.) C:\Users\Justus\Downloads\DropboxInstaller (1).exe
2014-04-22 23:44 - 2014-04-22 23:44 - 00001499 _____ () C:\Users\Justus\.recently-used.xbel
2014-04-18 17:02 - 2014-04-18 17:04 - 00009843 _____ () C:\Users\Justus\Desktop\Sammlung.txt
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-04-15 00:14 - 2014-04-15 00:14 - 01070496 _____ (Unity Technologies ApS) C:\Users\Justus\Downloads\UnityWebPlayer.exe
2014-04-15 00:14 - 2014-04-15 00:14 - 00000000 ____D () C:\Users\Justus\AppData\Local\Unity
2014-04-14 13:39 - 2014-05-04 20:45 - 00000000 ____D () C:\Users\Justus\Desktop\Keta-Forum
2014-04-11 20:29 - 2014-04-11 20:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\Users\Justus\AppData\Local\IBM
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\ProgramData\SafeNet Sentinel
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\SPSS
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
2014-04-10 17:30 - 2014-04-10 17:30 - 00000000 ____D () C:\Program Files\Common Files\IBM
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000219 _____ () C:\Windows\SysWOW64\lsprst7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00000205 _____ () C:\Windows\SysWOW64\lsprst7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000016 ____H () C:\Windows\SysWOW64\servdat.slm
2014-04-10 17:29 - 2014-04-10 17:29 - 00000000 ____D () C:\Program Files\IBM
2014-04-10 17:22 - 2014-04-10 17:22 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-04-10 17:21 - 2014-04-10 17:21 - 00000000 ___HD () C:\Users\Justus\InstallAnywhere
2014-04-10 17:20 - 2014-04-10 17:23 - 812131760 _____ (IBM Corp) C:\Users\Justus\Downloads\SPSS_Statistics_22_win64_.exe
2014-04-10 17:17 - 2014-04-10 17:18 - 95156272 _____ (Flexera Software) C:\Users\Justus\Downloads\SPSS_CnDS_50_StatsAdap_22_win64.exe
2014-04-10 13:58 - 2014-04-10 13:58 - 00000845 _____ () C:\Users\Justus\Downloads\vpn-extern.pcf
2014-04-10 13:56 - 2014-04-10 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\ProgramData\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Program Files\ShrewSoft
2014-04-10 13:54 - 2014-04-10 13:55 - 00009171 _____ () C:\install.log
2014-04-10 13:54 - 2014-04-10 13:54 - 03346256 _____ () C:\Users\Justus\Downloads\vpn-client-2.2.2-release.exe
2014-04-09 11:19 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 11:19 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 11:19 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 11:19 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 11:19 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 11:18 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 11:18 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 11:18 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 11:18 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 11:18 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 11:18 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 11:18 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-05 10:35 - 2014-05-04 23:37 - 00025789 _____ () C:\Users\Justus\Downloads\FRST.txt
2014-05-05 10:34 - 2014-05-04 23:37 - 00000000 ____D () C:\FRST
2014-05-05 10:25 - 2013-09-03 22:28 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Spotify
2014-05-05 10:24 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-05 10:24 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-05 10:17 - 2013-05-23 19:13 - 00000000 ____D () C:\Users\Justus\AppData\Local\LogMeIn Hamachi
2014-05-05 10:17 - 2011-09-17 20:37 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Skype
2014-05-05 10:15 - 2011-09-17 20:37 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-05 10:15 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-05 10:15 - 2009-07-14 06:51 - 00326854 _____ () C:\Windows\setupact.log
2014-05-05 00:37 - 2011-09-17 16:05 - 01263143 _____ () C:\Windows\WindowsUpdate.log
2014-05-05 00:31 - 2014-01-12 13:41 - 00000000 ____D () C:\Users\Justus\Documents\Citavi 4
2014-05-05 00:16 - 2014-05-04 22:57 - 00000000 ____D () C:\Program Files (x86)\LPT
2014-05-04 23:53 - 2012-03-31 10:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-04 23:46 - 2012-03-24 15:22 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA.job
2014-05-04 23:43 - 2011-09-17 20:37 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-04 23:39 - 2014-05-04 23:38 - 00043810 _____ () C:\Users\Justus\Downloads\Addition.txt
2014-05-04 23:36 - 2014-05-04 23:36 - 02062336 _____ (Farbar) C:\Users\Justus\Downloads\FRST64.exe
2014-05-04 23:16 - 2014-05-04 22:58 - 00000286 _____ () C:\Windows\Tasks\RegClean Pro_UPDATES.job
2014-05-04 23:16 - 2014-05-04 22:58 - 00000278 _____ () C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2014-05-04 23:07 - 2014-05-04 22:57 - 00002733 _____ () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-04 23:01 - 2014-05-04 23:00 - 00000000 ____D () C:\Program Files\RrFilter
2014-05-04 23:00 - 2014-05-04 23:00 - 00000000 ____D () C:\Program Files (x86)\Rr Savings
2014-05-04 22:59 - 2014-05-04 22:59 - 00000000 ____D () C:\Program Files\rrsavings
2014-05-04 22:59 - 2014-05-04 22:59 - 00000000 ____D () C:\Program Files\002
2014-05-04 22:58 - 2014-05-04 22:58 - 00003326 _____ () C:\Windows\System32\Tasks\Advanced System Protector
2014-05-04 22:58 - 2014-05-04 22:58 - 00003120 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-05-04 22:58 - 2014-05-04 22:58 - 00003032 _____ () C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2014-05-04 22:58 - 2014-05-04 22:58 - 00002876 _____ () C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\ProgramData\Systweak
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Program Files (x86)\ConstaSurf
2014-05-04 22:58 - 2014-05-04 22:57 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Systweak
2014-05-04 22:57 - 2014-05-04 22:57 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-05-04 22:57 - 2011-09-17 16:13 - 00000000 ___RD () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-04 22:55 - 2014-05-04 22:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Smartbar
2014-05-04 22:55 - 2014-05-04 22:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\LPT
2014-05-04 20:46 - 2012-03-24 15:22 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core.job
2014-05-04 20:45 - 2014-04-14 13:39 - 00000000 ____D () C:\Users\Justus\Desktop\Keta-Forum
2014-05-04 20:41 - 2012-03-24 15:22 - 00004096 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA
2014-05-04 20:41 - 2012-03-24 15:22 - 00003700 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core
2014-05-04 19:44 - 2014-01-16 11:17 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Dropbox
2014-05-03 14:45 - 2013-09-24 21:51 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\TS3Client
2014-05-03 14:02 - 2011-09-17 22:18 - 00000000 ____D () C:\Users\Justus\AppData\Local\PMB Files
2014-05-02 11:31 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Battle.net
2014-05-02 11:30 - 2014-04-28 22:43 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-05-01 23:48 - 2014-05-01 23:42 - 00000000 ____D () C:\Users\Justus\Desktop\UF-Text
2014-05-01 23:27 - 2012-01-03 22:31 - 00000000 ____D () C:\Users\Justus\Desktop\texte
2014-04-30 13:18 - 2011-11-23 18:41 - 00666112 ___SH () C:\Users\Justus\Downloads\Thumbs.db
2014-04-29 18:00 - 2014-05-03 15:22 - 23133184 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 17:24 - 2014-05-03 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 16:47 - 2014-05-03 15:22 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 16:14 - 2014-05-03 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 08:41 - 2011-09-17 22:18 - 00000000 ____D () C:\ProgramData\PMB Files
2014-04-28 23:12 - 2014-04-28 23:12 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard
2014-04-28 23:12 - 2014-04-28 23:06 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-28 23:06 - 2014-04-28 23:06 - 00001167 _____ () C:\Users\Public\Desktop\Hearthstone.lnk
2014-04-28 23:06 - 2014-04-28 23:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-04-28 23:06 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00001130 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard Entertainment
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-04-28 22:40 - 2014-04-28 22:40 - 07094224 _____ (Blizzard Entertainment) C:\Users\Justus\Downloads\Hearthstone-Setup-deDE.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00000000 ____D () C:\ProgramData\Battle.net
2014-04-28 21:55 - 2012-03-31 10:18 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 21:55 - 2012-03-31 10:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 21:55 - 2011-09-18 04:42 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 14:01 - 2014-04-23 15:06 - 00000000 ____D () C:\Users\Justus\Desktop\Stiendium
2014-04-26 19:42 - 2014-03-28 16:16 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Arc
2014-04-24 20:27 - 2013-09-03 22:28 - 00000000 ____D () C:\Users\Justus\AppData\Local\Spotify
2014-04-24 15:12 - 2013-12-28 13:50 - 00000000 ____D () C:\Users\Justus\AppData\Local\Akamai
2014-04-23 15:55 - 2014-01-16 11:19 - 00000000 ___RD () C:\Users\Justus\Dropbox
2014-04-23 12:31 - 2014-01-16 11:19 - 00001029 _____ () C:\Users\Justus\Desktop\Dropbox.lnk
2014-04-23 12:31 - 2014-01-16 11:17 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-23 12:30 - 2014-04-23 12:30 - 00316160 _____ (Dropbox, Inc.) C:\Users\Justus\Downloads\DropboxInstaller (1).exe
2014-04-22 23:44 - 2014-04-22 23:44 - 00001499 _____ () C:\Users\Justus\.recently-used.xbel
2014-04-22 23:44 - 2011-11-17 23:44 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\gtk-2.0
2014-04-22 23:44 - 2011-11-17 23:35 - 00000000 ____D () C:\Users\Justus\.gimp-2.6
2014-04-22 23:44 - 2011-09-17 16:13 - 00000000 ____D () C:\Users\Justus
2014-04-22 18:13 - 2013-12-20 11:51 - 00000000 ____D () C:\Users\Justus\Desktop\1UNIDUE
2014-04-22 14:54 - 2013-11-03 18:33 - 00000000 ____D () C:\Users\Justus\Desktop\Gutes_Zeug_Listen
2014-04-18 17:04 - 2014-04-18 17:02 - 00009843 _____ () C:\Users\Justus\Desktop\Sammlung.txt
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-04-16 14:57 - 2014-02-27 16:34 - 00000932 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-04-16 09:30 - 2012-03-17 11:39 - 00000000 ____D () C:\Users\Justus\Desktop\Wolfsträume
2014-04-16 09:30 - 2012-01-26 00:11 - 00000000 ____D () C:\Users\Justus\Desktop\E-Dokumente
2014-04-16 09:30 - 2011-10-10 15:47 - 00000000 ____D () C:\Users\Justus\Desktop\rp
2014-04-16 09:29 - 2011-12-04 17:26 - 00000000 ____D () C:\Users\Justus\Desktop\Unterortner
2014-04-16 09:29 - 2011-09-17 20:47 - 00000000 ____D () C:\Users\Justus\Desktop\spiele
2014-04-15 00:14 - 2014-04-15 00:14 - 01070496 _____ (Unity Technologies ApS) C:\Users\Justus\Downloads\UnityWebPlayer.exe
2014-04-15 00:14 - 2014-04-15 00:14 - 00000000 ____D () C:\Users\Justus\AppData\Local\Unity
2014-04-14 15:38 - 2013-03-15 14:09 - 00000000 ____D () C:\Users\Justus\Desktop\Spiel
2014-04-12 10:27 - 2012-06-14 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-11 20:30 - 2014-04-11 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\Users\Justus\AppData\Local\IBM
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\ProgramData\SafeNet Sentinel
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\SPSS
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
2014-04-10 17:30 - 2014-04-10 17:30 - 00000000 ____D () C:\Program Files\Common Files\IBM
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000219 _____ () C:\Windows\SysWOW64\lsprst7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00000205 _____ () C:\Windows\SysWOW64\lsprst7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000016 ____H () C:\Windows\SysWOW64\servdat.slm
2014-04-10 17:29 - 2014-04-10 17:29 - 00000000 ____D () C:\Program Files\IBM
2014-04-10 17:23 - 2014-04-10 17:20 - 812131760 _____ (IBM Corp) C:\Users\Justus\Downloads\SPSS_Statistics_22_win64_.exe
2014-04-10 17:22 - 2014-04-10 17:22 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-04-10 17:21 - 2014-04-10 17:21 - 00000000 ___HD () C:\Users\Justus\InstallAnywhere
2014-04-10 17:18 - 2014-04-10 17:17 - 95156272 _____ (Flexera Software) C:\Users\Justus\Downloads\SPSS_CnDS_50_StatsAdap_22_win64.exe
2014-04-10 14:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 13:58 - 2014-04-10 13:58 - 00000845 _____ () C:\Users\Justus\Downloads\vpn-extern.pcf
2014-04-10 13:56 - 2014-04-10 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\ProgramData\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Program Files\ShrewSoft
2014-04-10 13:55 - 2014-04-10 13:54 - 00009171 _____ () C:\install.log
2014-04-10 13:54 - 2014-04-10 13:54 - 03346256 _____ () C:\Users\Justus\Downloads\vpn-client-2.2.2-release.exe
2014-04-10 11:08 - 2011-11-15 18:35 - 00000000 ____D () C:\Users\Justus\AppData\Local\Mozilla
2014-04-09 14:00 - 2011-10-03 17:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 13:59 - 2013-07-15 14:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 13:57 - 2011-09-30 08:18 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Justus\AppData\Local\Temp\032939rr.exe
C:\Users\Justus\AppData\Local\Temp\6_Offer_12.exe
C:\Users\Justus\AppData\Local\Temp\ApnStub.exe
C:\Users\Justus\AppData\Local\Temp\AskSLib.dll
C:\Users\Justus\AppData\Local\Temp\BackupSetup.exe
C:\Users\Justus\AppData\Local\Temp\bdfilters.dll
C:\Users\Justus\AppData\Local\Temp\CmdLineExt.dll
C:\Users\Justus\AppData\Local\Temp\CmdLineExt03.dll
C:\Users\Justus\AppData\Local\Temp\comver.dll
C:\Users\Justus\AppData\Local\Temp\contentDATs.exe
C:\Users\Justus\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Justus\AppData\Local\Temp\drm_dyndata_7330017.dll
C:\Users\Justus\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Justus\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuekmt2.dll
C:\Users\Justus\AppData\Local\Temp\GoogleToolbarInstaller.exe
C:\Users\Justus\AppData\Local\Temp\gtapi.dll
C:\Users\Justus\AppData\Local\Temp\installhelper.dll
C:\Users\Justus\AppData\Local\Temp\instloffer.exe
C:\Users\Justus\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Justus\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Justus\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe
C:\Users\Justus\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Justus\AppData\Local\Temp\NGMDll.dll
C:\Users\Justus\AppData\Local\Temp\NGMResource.dll
C:\Users\Justus\AppData\Local\Temp\NGMSetup.exe
C:\Users\Justus\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Justus\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\Justus\AppData\Local\Temp\Shortcut_Shortcut_sweetimsetup.exe
C:\Users\Justus\AppData\Local\Temp\Shortcut_sweetimsetup.exe
C:\Users\Justus\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Justus\AppData\Local\Temp\SIntf16.dll
C:\Users\Justus\AppData\Local\Temp\SIntf32.dll
C:\Users\Justus\AppData\Local\Temp\SIntfNT.dll
C:\Users\Justus\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Justus\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Justus\AppData\Local\Temp\SRLDetectionLibrary7949106527364205144.dll
C:\Users\Justus\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Justus\AppData\Local\Temp\ubiD60D.tmp.exe
C:\Users\Justus\AppData\Local\Temp\unicows.dll
C:\Users\Justus\AppData\Local\Temp\_is673.exe
C:\Users\Justus\AppData\Local\Temp\_is6F8F.exe
C:\Users\Justus\AppData\Local\Temp\_isB053.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 12:38
Addition:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-05-2014
Ran by Justus at 2014-05-05 10:37:54
Running from C:\Users\Justus\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Advanced System Protector (HKLM-x32\...\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1) (Version: 2.1.1000.12594 - Systweak Software) <==== ATTENTION
Aeria Ignite (HKLM-x32\...\Aeria Ignite 1.13.3296) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (HKLM-x32\...\Aeria Ignite) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden
AION Free-To-Play (HKLM-x32\...\InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}) (Version: 2.70.0000 - Gameforge)
AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge) Hidden
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Anvil Studio (HKLM-x32\...\{0CA67D17-24C3-44DE-A34E-98ACEC9954A9}) (Version: 13.08.01 - Willow Software)
Anvil Studio 2011 (HKLM-x32\...\{8CFACA27-1CE9-4E90-BCAD-666BA09A048B}) (Version: 11.05.05 - Willow Software)
Anvil Studio 2012 (HKLM-x32\...\{2181D49A-980D-44F6-9C62-2D8B9E63EAEF}) (Version: 12.06.09 - Willow Software)
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.14.1.0 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.0.20007 - Ask.com) <==== ATTENTION
Assassin's Creed (HKLM-x32\...\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.02 - Ubisoft)
Babylon toolbar on IE (HKLM-x32\...\BabylonToolbar) (Version:  - ) <==== ATTENTION
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - )
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 2(TM) (HKLM-x32\...\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}) (Version:  - )
Battlefield 2: Special Forces (HKLM-x32\...\{50D4CB89-AF34-4978-96DC-C3034062E901}) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bridge Building Game (HKLM-x32\...\Bridge Building Game) (Version:  - )
Circle of Eight Modpack version 7.1.0 NC (HKLM-x32\...\{33BB97DA-E495-4413-AE56-594AF9221E8B}_is1) (Version: 7.1.0 NC - Circle of Eight)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.2.0.11 - Swiss Academic Software)
Company of Heroes - FAKEMSI (x32 Version: 2.0.0.0 - THQ Inc.) Hidden
Company of Heroes (HKLM-x32\...\Company of Heroes) (Version: 2.602.0 - THQ Inc.)
ConstaSurf (HKLM\...\ConstaSurf) (Version: 2014.03.26.182311 - ConstaSurf)
Counter-Strike 1.6 (HKLM-x32\...\{13B792AA-C078-43A4-8A3A-8B12D629940D}) (Version: 1.00.0000 - )
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version:  - Microsoft)
Dragon Age: Origins (HKLM-x32\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.00 - Electronic Arts, Inc.)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.31 - Dropbox, Inc.)
Empire Earth III (HKLM-x32\...\{B17E235C-7A3B-4482-B650-21FFDE1D452E}) (Version: 1.00.0000 - Sierra Entertainment)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\Firebird SQL Server D) (Version: 2.0.1.13 - MAGIX AG)
Free YouTube to MP3 Converter version 3.12.17.1127 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.17.1127 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
Gameforge Live 1.3.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.3.0 - Gameforge)
GameSpy Arcade (HKLM-x32\...\GameSpy Arcade) (Version:  - )
Garena Classic 2011 (HKLM-x32\...\Garena Classic 2011) (Version: 2011 - Garena Online Pte Ltd.)
GIMP 2.6.11 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google SketchUp 8 (HKLM-x32\...\{4BA6784F-3B10-473A-B9F5-33A36AC354D5}) (Version: 3.0.14358 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
GPGNet (HKLM-x32\...\{C194D333-B84A-4BB7-B35E-060732D98DC4}) (Version: 1.0.0 - Gas Powered Games)
Gratuitous Space Battles Demo (HKLM-x32\...\Gratuitous Space Battles Demo_is1) (Version:  - Positech Games)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Hellgate: London (HKLM\...\{A2B4455D-1046-4732-BFBC-0821BEFC07BC}) (Version: 1.10.180.3416 - Flagship Studios)
Heroes of Might and Magic® III (HKLM-x32\...\Heroes of Might and Magic® III) (Version:  - )
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
IBM SPSS Statistics 22 (HKLM\...\{104875A1-D083-4A34-BC4F-3F635B7F8EF7}) (Version: 22.0.0.0 - IBM Corp)
iLivid (HKLM-x32\...\iLivid) (Version: 4.0.0.2466 - Bandoo Media Inc) <==== ATTENTION
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2302 - Intel Corporation)
iTunes (HKLM\...\{76FF0F03-B707-4332-B5D1-A56C8303514E}) (Version: 11.0.4.4 - Apple Inc.)
Java Auto Updater (x32 Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle)
Java(TM) 7 Update 5 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217005FF}) (Version: 7.0.50 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Kalydo Player 5.01.00 (HKCU\...\KalydoPlayer) (Version: 5.01.00 - Eximion B.V.)
League of Legends (HKLM-x32\...\{918A9082-6287-4D25-9002-5E5D5E4971CB}) (Version: 1.02.0000 - Riot Games)
Loadout (HKLM-x32\...\Steam App 208090) (Version:  - Edge of Reality)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.188 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.188 - LogMeIn, Inc.) Hidden
LPT System Updater Service (x32 Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION
MAGIX Foto Manager 8 6.0.1.457 (D) (HKLM-x32\...\MAGIX Foto Manager 8 D) (Version: 6.0.1.457 - MAGIX AG)
MAGIX Fotobuch 3.6 (HKLM-x32\...\MAGIX Fotobuch) (Version: 3.6 - MAGIX AG)
MAGIX Goya burnR 1.3.1.3 (D) (HKLM-x32\...\MAGIX Goya burnR D) (Version: 1.3.1.3 - MAGIX AG)
MAGIX Music Maker for MySpace 15.0.1.8 (D) (HKLM-x32\...\MAGIX Music Maker for MySpace D) (Version: 15.0.1.8 - MAGIX AG)
MAGIX Music Maker Rock Edition 3 5.0.0.0 (D) (HKLM-x32\...\MAGIX Music Maker Rock Edition 3 D) (Version: 5.0.0.0 - MAGIX AG)
MAGIX Online Druck Service 3.4.3.0 (D) (HKLM-x32\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MP3 Skype Recorder (HKLM-x32\...\{CB606F47-7D0E-40DF-95BB-0E5413A1295F}) (Version: 3.1.3 - Alexander Nikiforov)
MP4 To MP3 Converter V3.0.4 (HKLM-x32\...\MP4 To MP3 Converter_is1) (Version:  - hxxp://www.MP4ToMP3Converter.net)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mumble 1.2.4 (HKLM-x32\...\{AF348C2E-7596-481B-92E0-B211836AB949}) (Version: 1.2.4 - Thorvald Natvig)
Mumble(PR edition) and Murmur(PR edition) (HKLM-x32\...\Mumble(PR Edition)) (Version: 1.1.8 - Mumble(PR Edition))
MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION
NC Launcher (GameForge) (HKLM-x32\...\NCLauncher_GameForge) (Version:  - NCsoft)
Nexon Game Manager (HKLM-x32\...\{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}) (Version:  - )
NVIDIA PhysX (HKLM-x32\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation)
Oblivion (HKLM-x32\...\{35CB6715-41F8-4F99-8881-6FC75BF054B0}) (Version: 1.00.0000 - Bethesda Softworks)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Overwolf (HKLM-x32\...\{48615A7B-F026-4F62-A3F1-49001B8E21CB}) (Version: 0.44.256 - Overwolf)
Overwolf.Setup.VC100CRTx64.Dist (HKLM\...\{EC9D5554-6852-4A55-81BB-AC02C7A8CFED}) (Version: 1.0.0 - Overwolf)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.3.6.0 - Pando Networks Inc.)
Path of Exile (HKLM-x32\...\{90A4562F-D4A1-4B65-906D-41F236CF6902}) (Version: 0.10.0.22479 - Grinding Gear Games)
Path of Exile (HKLM-x32\...\Steam App 238960) (Version:  - Grinding Gear Games)
Pool of Radiance (HKLM-x32\...\Pool of Radiance) (Version:  - )
PR Mumble 1.0.0 (HKLM-x32\...\{AF8EEB05-8E9B-438B-B73B-DF9191DF29DD}) (Version: 1.0.0 - Project Reality Team)
Project Reality: BF2 (HKLM\...\Project Reality: BF2 (pr)_is1) (Version: v1.0 - Project Reality)
Project Reality: BF2 (HKLM-x32\...\Project Reality: BF2 (pr)_is1) (Version: v0.981 - Project Reality)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Quantum GIS Wroclaw 1.7.4 Wroclaw (HKLM-x32\...\Quantum GIS Wroclaw) (Version: 1.7.4-r67332-1 - QGIS Development Team)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version:  - Realtek Semiconductor Corp.)
RegClean Pro (HKLM-x32\...\RegClean Pro_is1) (Version: 6.21 - Systweak Inc) <==== ATTENTION
Rise Of Legends (HKLM-x32\...\InstallShield_{CADDE354-C78C-46CB-A006-E2B178EFC271}) (Version: 1.00.0000 - Microsoft Game Studios)
Rise Of Legends (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Rochard (HKLM-x32\...\Recoil Games Rochard) (Version: 1.31 - Recoil Games)
RrFilter (Version: 1.0.0.0 - RrFilter) Hidden
rrsavings (HKLM\...\rrsavings) (Version: 2.0.1 - rrsavings) <==== ATTENTION
RrSavings (x32 Version: 1.0.0.0 - RrSavings) Hidden <==== ATTENTION
Runes of Magic (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 5.0.5.2592 - Gameforge Productions GmbH)
RunesOfMagic (HKCU\...\Kalydo App RunesOfMagic) (Version: 5.00.10.2634 - )
Sandbox (HKLM-x32\...\Sandbox) (Version:  - )
ScarletBlade-DE (HKLM-x32\...\ScarletBlade-DE) (Version:  - )
Searchqu Toolbar (HKLM-x32\...\Searchqu Toolbar) (Version: 3.0.0.122375 - Bandoo Media Inc) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Shatter (HKLM-x32\...\{84D008A6-8159-442E-8FD8-0148EF42F3E0}) (Version: 1.0.5 - Sidhe Interactive)
Shopping Helper Smartbar (HKLM-x32\...\{B2A302E7-8FA4-4585-AB7F-12C4DEBC0D32}) (Version: 11.44.63.16736 - ReSoft Ltd.) <==== ATTENTION
Shopping Helper Smartbar Engine (HKCU\...\{8871ae0e-83d5-4f7d-b65f-15f39a770946}) (Version: 11.44.63.16736 - ReSoft Ltd.) <==== ATTENTION
Shrew Soft VPN Client (HKLM\...\Shrew Soft VPN Client) (Version:  - )
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 0.1.1404.1 - Hi-Rez Studios)
SpeedSim (HKLM-x32\...\SpeedSim) (Version: 0.9.8.1b - )
Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Square Enix Secure Launcher (HKCU\...\Square Enix Secure Launcher) (Version: 1.0.0.108 - Square Enix)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Stronghold (HKLM-x32\...\{C917BA70-28A3-4C74-B163-41FD8C8E1A5A}) (Version: 1.20.0000 - Firefly Studios)
Stronghold 2 (HKLM-x32\...\{16D2C649-CBA8-44EE-B730-12584667D487}) (Version: 1.40.1000 - Firefly Studios)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Stronghold Legends (HKLM-x32\...\{66A405D2-BA14-4594-BF36-B3B544F0754E}) (Version: 1.20.0000 - Firefly Studios)
Supreme Commander (HKLM-x32\...\{25A1E6A4-2DBD-4AC0-8650-8EA9A45B183D}) (Version: 1.00.0000 - Gas Powered Games)
System Requirements Lab CYRI (HKLM-x32\...\{F3FCB08B-E752-444D-86A0-0634A4F3B23D}) (Version: 6.0.8.0 - Husdawg, LLC)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
Temple of Elemental Evil (HKLM-x32\...\{AD80F06B-0F21-4EEE-934D-BEF0D21E6383}) (Version: 1.00.000 - )
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
The Mighty Quest For Epic Loot (HKLM-x32\...\Steam App 239220) (Version:  - Ubisoft Montreal)
Tixati (HKLM-x32\...\tixati) (Version:  - )
Torchlight (HKLM-x32\...\Runic Games Torchlight) (Version: 1.15 - )
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{4B93560B-F33D-4A67-A224-F5E1C329BD22}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)
Vampire - The Masquerade Bloodlines (HKLM-x32\...\InstallShield_{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}) (Version: 1.00.0000 - Activision)
Vampire - The Masquerade Bloodlines (x32 Version: 1.00.0000 - Activision) Hidden
Vindictus (HKLM-x32\...\Vindictus) (Version:  - )
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
VLC classic (HKLM-x32\...\VLC classic) (Version: 1.14 - vlcplayerdownload.com)
Zotero Standalone 3.0.3 (x86 en-US) (HKLM-x32\...\Zotero Standalone 3.0.3 (x86 en-US)) (Version: 3.0.3 - Zotero)

==================== Restore Points  =========================

29-04-2014 06:42:18 Windows Update
02-05-2014 14:05:48 Windows Update
03-05-2014 13:21:50 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0FEC9024-6A69-4E01-A149-471085A57A79} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-17] (Google Inc.)
Task: {28777AC0-3CFC-4F12-946E-C49E13437D37} - System32\Tasks\{FC7D3E8E-6CAB-4883-BE8C-7C4D9934DFEA} => C:\Program Files (x86)\Activision\Vampire - Bloodlines\vampire.exe [2004-10-07] ()
Task: {2FE17B99-79E9-44DD-B6E1-3AFEBF87FB6E} - System32\Tasks\{D1D2EE18-C35B-4FD0-A32B-43B0EF320AD8} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)
Task: {3FE19472-DEF4-43F6-8112-BC2E7A4BD732} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {452CB112-38D8-44D1-8F3A-EDF40AA6E24E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA => C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-24] (Google Inc.)
Task: {7FAA1B7E-71FC-48B5-80EB-F0B41519E1B8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core => C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-24] (Google Inc.)
Task: {8472B045-F9B2-4F0B-B834-03A9EC61DF04} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {8CBD5030-6746-45E3-96C9-1D4906FA5801} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-01-03] () <==== ATTENTION
Task: {94462F03-62AA-4135-8972-333EF6636CBE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-17] (Google Inc.)
Task: {9BEC7C97-F4B2-4B09-BE82-AB54AE4DD370} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C3E1A596-4FA0-4188-8766-C2734AF27186} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {E813421F-92D9-49AB-B1C3-F08CC651B455} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {E873B3A6-A161-43B7-A87F-3BAD84302A79} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe <==== ATTENTION
Task: {EAA78477-A22D-4950-90CE-1AE8D11BD5D6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-28] (Adobe Systems Incorporated)
Task: {F99DDAAA-B78C-4270-B5E6-8D1E0CC48D04} - System32\Tasks\{9E7701E4-2E7B-4E8A-AA39-46A4B28DA5E3} => Chrome.exe hxxp://ui.skype.com/ui/0/6.1.0.129.272/de/abandoninstall?page=tsProgressBar
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core.job => C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA.job => C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2013-07-01 10:21 - 2013-07-01 10:21 - 01127736 _____ () C:\Program Files\ShrewSoft\VPN Client\iked.exe
2013-07-01 01:16 - 2013-07-01 01:16 - 00628224 _____ () C:\Program Files\ShrewSoft\VPN Client\libike.dll
2013-07-01 01:15 - 2013-07-01 01:15 - 00022016 _____ () C:\Program Files\ShrewSoft\VPN Client\libidb.dll
2013-07-01 01:15 - 2013-07-01 01:15 - 00018432 _____ () C:\Program Files\ShrewSoft\VPN Client\libith.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00039936 _____ () C:\Program Files\ShrewSoft\VPN Client\libvnet.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00013312 _____ () C:\Program Files\ShrewSoft\VPN Client\liblog.dll
2013-07-01 01:16 - 2013-07-01 01:16 - 00116736 _____ () C:\Program Files\ShrewSoft\VPN Client\libip.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00029184 _____ () C:\Program Files\ShrewSoft\VPN Client\libpfk.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00017920 _____ () C:\Program Files\ShrewSoft\VPN Client\libdtp.dll
2013-07-01 01:17 - 2013-07-01 01:17 - 00035840 _____ () C:\Program Files\ShrewSoft\VPN Client\libvflt.dll
2013-07-01 10:21 - 2013-07-01 10:21 - 00810808 _____ () C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
2014-04-23 17:16 - 2014-04-23 17:16 - 00037920 _____ () C:\Program Files (x86)\LPT\srpts.exe
2011-11-22 18:47 - 2013-08-28 22:01 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-03-06 15:52 - 2014-03-06 15:52 - 00171008 _____ () c:\Program Files\RrFilter\RrFilterService64.exe
2014-03-04 13:25 - 2014-03-04 13:25 - 00110080 _____ () c:\Program Files\RrFilter\nfapi.dll
2014-03-04 13:25 - 2014-03-04 13:25 - 00317952 _____ () c:\Program Files\RrFilter\ProtocolFilters.dll
2014-05-04 22:59 - 2014-05-04 22:59 - 00706560 _____ () C:\Program Files\002\yewimmxqbs64.exe
2013-09-23 17:54 - 2014-04-08 21:10 - 00602680 _____ () C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
2014-04-23 17:16 - 2014-04-23 17:16 - 00023072 _____ () C:\Users\Justus\AppData\Local\LPT\srptm.exe
2012-02-20 21:29 - 2012-02-20 21:29 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 21:28 - 2012-02-20 21:28 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-03 22:28 - 2014-04-08 21:11 - 36966968 _____ () C:\Users\Justus\AppData\Roaming\Spotify\Data\libcef.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00047136 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00069152 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\srau.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00165920 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 02336288 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00067104 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\spbl.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00155680 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00014368 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\siem.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00066080 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\sppsm.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00696864 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00014880 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00078880 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00027168 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00056864 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\srut.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00029216 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\srsbs.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00065568 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00054304 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\smti.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00031264 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\srom.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00030752 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\smtu.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00038944 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\smta.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00044064 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\srbu.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00024096 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\sgml.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00061472 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00024608 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\srpdm.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00043552 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\MACTrackBarLib.dll
2014-04-23 17:14 - 2014-04-23 17:14 - 00026656 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00035360 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00193056 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\sgmu.dll
2014-04-23 17:12 - 2014-04-23 17:12 - 00061440 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\AxInterop.WMPLib.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00255520 _____ () C:\Users\Justus\AppData\Local\Smartbar\Application\srns.dll
2014-04-10 16:04 - 2014-04-02 03:57 - 00065352 _____ () C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll
2014-04-10 16:04 - 2014-04-02 03:57 - 00674632 _____ () C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\libglesv2.dll
2014-04-10 16:04 - 2014-04-02 03:57 - 00093000 _____ () C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\libegl.dll
2011-01-17 17:19 - 2011-12-03 16:45 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-04-10 16:04 - 2014-04-02 03:57 - 04081480 _____ () C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll
2014-04-10 16:04 - 2014-04-02 03:58 - 00390472 _____ () C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
2014-04-10 16:04 - 2014-04-02 03:57 - 01647432 _____ () C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00081952 _____ () C:\Program Files (x86)\LPT\srpt.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00023072 _____ () C:\Program Files (x86)\LPT\srptc.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00018976 _____ () C:\Program Files (x86)\LPT\Smartbar.Common.dll
2013-09-23 17:54 - 2014-04-08 21:10 - 00886840 _____ () C:\Users\Justus\AppData\Roaming\Spotify\Data\libglesv2.dll
2013-09-23 17:54 - 2014-04-08 21:10 - 00108600 _____ () C:\Users\Justus\AppData\Roaming\Spotify\Data\libegl.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00081952 _____ () C:\Users\Justus\AppData\Local\LPT\srpt.dll
2014-04-23 17:16 - 2014-04-23 17:16 - 00023072 _____ () C:\Users\Justus\AppData\Local\LPT\srptc.dll
2014-04-23 17:15 - 2014-04-23 17:15 - 00018976 _____ () C:\Users\Justus\AppData\Local\LPT\Smartbar.Common.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^Users^Justus^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: DATAMNGR => C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE
MSCONFIG\startupreg: Google Update => "C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Pando Media Booster => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Shrew Soft Virtual Adapter
Description: Shrew Soft Virtual Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Shrew Soft
Service: vnet
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/05/2014 10:16:55 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/04/2014 11:17:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/04/2014 11:00:24 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MsiExec.exe, Version: 5.0.7601.17514, Zeitstempel: 0x4ce792c4
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000efc6
ID des fehlerhaften Prozesses: 0x11e4
Startzeit der fehlerhaften Anwendung: 0xMsiExec.exe0
Pfad der fehlerhaften Anwendung: MsiExec.exe1
Pfad des fehlerhaften Moduls: MsiExec.exe2
Berichtskennung: MsiExec.exe3

Error: (05/04/2014 10:59:06 PM) (Source: Application Hang) (User: )
Description: Programm 1_Offer_7.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 126c

Startzeit: 01cf67db9106a43e

Endzeit: 7

Anwendungspfad: C:\Users\Justus\AppData\Local\Temp\1_Offer_7.exe

Berichts-ID:

Error: (05/04/2014 07:44:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/04/2014 09:31:57 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2014 09:17:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2014 03:52:15 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2014 02:03:04 PM) (Source: BugSplat) (User: )
Description: Pando_WinPando6784711

Error: (05/03/2014 09:03:38 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (05/05/2014 10:15:56 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LMIGuardianSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (05/05/2014 10:15:56 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LMIGuardianSvc erreicht.

Error: (05/05/2014 10:15:13 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/04/2014 11:18:53 PM) (Source: DCOM) (User: )
Description: {CC957078-B838-47C4-A7CF-626E7A82FC58}

Error: (05/04/2014 11:16:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/04/2014 11:05:53 PM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Installer" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (05/04/2014 11:02:00 PM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Installer" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056

Error: (05/04/2014 11:00:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Installer" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 300000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/04/2014 11:00:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/04/2014 07:46:00 PM) (Source: DCOM) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}


Microsoft Office Sessions:
=========================
Error: (05/05/2014 10:16:55 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/04/2014 11:17:50 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/04/2014 11:00:24 PM) (Source: Application Error)(User: )
Description: MsiExec.exe5.0.7601.175144ce792c4ole32.dll6.1.7601.175144ce7b96fc00000050000efc611e401cf67dbdd303707c:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\ole32.dll1c493e60-d3cf-11e3-bf43-003067abfac7

Error: (05/04/2014 10:59:06 PM) (Source: Application Hang)(User: )
Description: 1_Offer_7.exe0.0.0.0126c01cf67db9106a43e7C:\Users\Justus\AppData\Local\Temp\1_Offer_7.exe

Error: (05/04/2014 07:44:54 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/04/2014 09:31:57 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2014 09:17:38 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2014 03:52:15 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2014 02:03:04 PM) (Source: BugSplat)(User: )
Description: Pando_WinPando6784711

Error: (05/03/2014 09:03:38 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 57%
Total physical RAM: 4061.24 MB
Available physical RAM: 1721.67 MB
Total Pagefile: 8120.66 MB
Available Pagefile: 5406.38 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:465.76 GB) (Free:128.84 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive f: (Intenso) (Fixed) (Total:465.76 GB) (Free:368.33 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 545C0A3F)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 0B4F915B)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
--- --- ---

--- --- ---


Grüße N

schrauber 06.05.2014 08:58
Revo Uninstaller - Download - Filepony
Damit alles deinstallieren was Du in der Additional.txt findest mit dem Zusatz <== ATTENTION

Mit Revo auch Moderat die Reste entfernen lassen.




Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

Nujakan 06.05.2014 20:55
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org


Update, 06.05.2014 19:20:24, SYSTEM, JUSTUS-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.3.27.1,
Update, 06.05.2014 19:20:26, SYSTEM, JUSTUS-PC, Manual, Malware Database, 2014.3.4.9, 2014.5.6.8,

(end)
Code:
# AdwCleaner v3.207 - Bericht erstellt am 06/05/2014 um 20:58:03
# Aktualisiert 05/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Justus - JUSTUS-PC
# Gestartet von : C:\Users\Justus\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : BackupStack
Dienst Gelöscht : RrFilterService64

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Systweak
Ordner Gelöscht : C:\Windows\Installer\{813BA625-B0FA-48D8-9B75-59759C88C219}
Ordner Gelöscht : C:\Windows\SysWOW64\AI_RecycleBin
Ordner Gelöscht : C:\Program Files\002
Ordner Gelöscht : C:\Program Files\RrFilter
Ordner Gelöscht : C:\Program Files\RrSavings
Ordner Gelöscht : C:\Users\Justus\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Justus\AppData\Local\LPT
Ordner Gelöscht : C:\Users\Justus\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Justus\AppData\Local\Temp\BabylonToolbar
Ordner Gelöscht : C:\Users\Justus\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\Justus\AppData\LocalLow\DataMngr
Ordner Gelöscht : C:\Users\Justus\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Justus\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Justus\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
Ordner Gelöscht : C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\kofjjfgnmnjmoihhmjpafcllkhinmboe
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Justus\AppData\Local\Temp\Searchqu.ini
Datei Gelöscht : C:\Users\Justus\AppData\Local\Temp\searchqutoolbar-manifest.xml
Datei Gelöscht : C:\Users\Justus\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
Datei Gelöscht : C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
Datei Gelöscht : C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Windows\System32\Tasks\Advanced System Protector
Datei Gelöscht : C:\Windows\System32\Tasks\Advanced System Protector_startup
Datei Gelöscht : C:\Windows\System32\Tasks\RegClean Pro
Datei Gelöscht : C:\Windows\Tasks\RegClean Pro_DEFAULT.job
Datei Gelöscht : C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
Datei Gelöscht : C:\Windows\Tasks\RegClean Pro_UPDATES.job
Datei Gelöscht : C:\Windows\System32\Tasks\RegClean Pro_UPDATES

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Mobogenie.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_gamespy-arcade_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_gamespy-arcade_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10AD2C61-0898-4348-8600-14A342F22AC3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\RrSavings
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Rr Savings
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\RrSavings
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3566FB70-E722-4182-8266-815EAE862998}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DataMngr
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\LevelQualityWatcher
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Rr Savings
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\RrSavings
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{813BA625-B0FA-48D8-9B75-59759C88C219}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RrSavings
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\07BF6653227E2814286618E5EA689289
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\526AB318AF0B8D84B9579557C9882C91
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\07BF6653227E2814286618E5EA689289
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\526AB318AF0B8D84B9579557C9882C91

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v28.0 (de)

[ Datei : C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\prefs.js ]

Zeile gelöscht : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B1ZU_z[...]
Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Zeile gelöscht : user_pref("browser.search.order.1", "Search Results");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?AF=17350&babsrc=NT_ss&mntrId=305e35620000000000000008549fe9f1");
Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Zeile gelöscht : user_pref("extensions.helperbar.Visibility", false);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCapacity", 3);
Zeile gelöscht : user_pref("extensions.helperbar.backPageCounter", 0);
Zeile gelöscht : user_pref("extensions.helperbar.backPageDay", 4);
Zeile gelöscht : user_pref("extensions.helperbar.backPageLastEvent", "1399064239242");
Zeile gelöscht : user_pref("extensions.helperbar.backPageMinInterval", 15);
Zeile gelöscht : user_pref("extensions.helperbar.barcodeid", "127714");
Zeile gelöscht : user_pref("extensions.helperbar.countryiso", "de");
Zeile gelöscht : user_pref("extensions.helperbar.downloadprovider", "ry_1955_ch");
Zeile gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\",\\\"www.only-apartments.es\\\",\\\"www.only-apartments.de\\\",\\\"www.only-apar[...]
Zeile gelöscht : user_pref("extensions.helperbar.fromautoupdate", "false");
Zeile gelöscht : user_pref("extensions.helperbar.installationid", "9e66b98d-b353-e16a-84c9-87bff1d9c2ca");
Zeile gelöscht : user_pref("extensions.helperbar.installdate", "04/05/2014");
Zeile gelöscht : user_pref("extensions.helperbar.keepAliveLastevent", "1399237039");
Zeile gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1399237041384");
Zeile gelöscht : user_pref("extensions.helperbar.publisher", "shoppinghelper");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWmwugvkecS8vMTddoFZ1JOSS-uAGUcMxkW0jIL_KJC7xZuVYxQVPGHQMG43X_7_DiA82iBr8Ozu9CsspYWCLcB511qc5B3zopX_KSIEKl[...]

-\\ Google Chrome v
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Justus on 06.05.2014 at 21:12:16,46
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\ProgramData\boost_interprocess"



~~~ FireFox

Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\Justus\AppData\Roaming\mozilla\firefox\profiles\y9t5g8z3.default\minidumps [28 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.05.2014 at 21:19:10,05
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2014
Ran by Justus (administrator) on JUSTUS-PC on 06-05-2014 21:51:08
Running from C:\Users\Justus\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Realtek Semiconductor) C:\Windows\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spotify Ltd) C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Akamai Technologies, Inc.) C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
() C:\Program Files\ShrewSoft\VPN Client\iked.exe
() C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Thisisu) C:\Users\Justus\Desktop\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6297088 2008-05-28] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252296 2012-01-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Aeria Ignite] => C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe [1925656 2013-06-06] (Aeria Games & Entertainment)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-04-15] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Google Update] => C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-03-24] (Google Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Spotify] => C:\Users\Justus\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-08] (Spotify Ltd)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Spotify Web Helper] => C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-08] (Spotify Ltd)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [GoogleChromeAutoLaunch_4B58CE89BFB61E88DC2FAC95911F6EFA] => C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\MountPoints2: {233aaba2-b816-11e2-9849-0008549fe9f1} - E:\Windows\CHECK\DriveNavigator.exe
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\MountPoints2: {7f9a167f-0fc1-11e3-9ef2-003067abfac7} - E:\autorun.exe
Startup: C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEC025D046775CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL =
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: ConstaSurf - {96cf2cbe-b6d5-454a-a62a-84bcda86ef1d} - C:\Program Files (x86)\ConstaSurf\ConstaSurfbho.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\MP3 Skype Recorder\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{C8DC7B6B-C500-463E-ADEE-1A9B04422CE7}: [NameServer]132.252.3.10,132.252.1.7

FireFox:
========
FF ProfilePath: C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @coreonline.com/run3d,version=1.0 - C:\Users\Justus\AppData\LocalLow\Square Enix\nprun3d.dll (Square Enix)
FF Plugin HKCU: @eximion.com/KalydoPlayer - C:\Users\Justus\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Justus\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Justus\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Justus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Zotero - C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\Extensions\zotero@chnm.gmu.edu [2012-08-07]
FF Extension: NoScript - C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-09-29]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-04-11]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-01-12]

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR StartupUrls: "hxxp://www.spiegel.de/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Extension: (YouTube) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-24]
CHR Extension: (Adblock Plus) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-02-01]
CHR Extension: (Google-Suche) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-24]
CHR Extension: (HTTPS Everywhere) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2012-03-24]
CHR Extension: (AdBlock) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-03-20]
CHR Extension: (Zotero Connector) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\jciblakmllnhbhjjgkbkeihelcndmgnh [2012-04-10]
CHR Extension: (Skype Click to Call) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-03-24]
CHR Extension: (Google Wallet) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Citavi Picker) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio [2014-01-12]
CHR Extension: (Google Mail) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-24]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-01-17]
CHR HKLM-x32\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx [2014-01-12]
CHR StartMenuInternet: Google Chrome - C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-04-18] (Perfect World Entertainment Inc)
R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] ()
R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-08] (LogMeIn, Inc.)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-28] ()
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [746392 2013-03-20] (Tunngle.net GmbH)
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [X]
S2 yewimmxqbs64; C:\Program Files\002\yewimmxqbs64.exe run options=01100010020000000000000000000000 sourceguid=3A5B3E40-3C96-4F4E-A48D-C161A8B0E1A6 [X]

==================== Drivers (Whitelisted) ====================

R1 BIOS; C:\Windows\system32\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
R1 BIOS; C:\Windows\SysWOW64\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
S3 E100B; C:\Windows\System32\DRIVERS\efe5b32e.sys [192256 2009-06-10] (Intel Corporation)
S3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-06] (Malwarebytes Corporation)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [61736 2014-02-28] (NetFilterSDK.com)
R3 rtl819xpn64; C:\Windows\System32\DRIVERS\rtl819xp.sys [570880 2009-05-18] (Realtek Semiconductor Corporation                          )
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Classic\safedrv.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-06 21:51 - 2014-05-06 21:51 - 00000000 ____D () C:\Users\Justus\Downloads\FRST-OlderVersion
2014-05-06 21:19 - 2014-05-06 21:19 - 00000866 _____ () C:\Users\Justus\Desktop\JRT.txt
2014-05-06 21:12 - 2014-05-06 21:12 - 00000000 ____D () C:\Windows\ERUNT
2014-05-06 21:11 - 2014-05-06 21:10 - 01016261 _____ (Thisisu) C:\Users\Justus\Desktop\JRT.exe
2014-05-06 21:10 - 2014-05-06 21:10 - 01016261 _____ (Thisisu) C:\Users\Justus\Downloads\JRT.exe
2014-05-06 21:06 - 2014-05-06 21:06 - 00015925 _____ () C:\Users\Justus\Desktop\AdwCleaner[S0].txt
2014-05-06 20:53 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-06 20:52 - 2014-05-06 21:02 - 00000000 ____D () C:\AdwCleaner
2014-05-06 20:50 - 2014-05-06 20:51 - 01316991 _____ () C:\Users\Justus\Desktop\adwcleaner.exe
2014-05-06 20:50 - 2014-05-06 20:50 - 00000262 _____ () C:\Users\Justus\Desktop\mbam.txt
2014-05-06 20:42 - 2014-05-06 20:48 - 00002279 _____ () C:\Users\Justus\Desktop\Neues Textdokument.txt
2014-05-06 19:20 - 2014-05-06 20:47 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-06 19:20 - 2014-05-06 19:20 - 00001112 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-06 19:20 - 2014-05-06 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-06 19:19 - 2014-05-06 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-06 19:19 - 2014-05-06 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-06 19:19 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-06 19:19 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-06 19:19 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-06 19:18 - 2014-05-06 19:18 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Justus\Desktop\mbam-setup-2.0.1.1004.exe
2014-05-06 18:53 - 2014-05-06 18:53 - 00000050 _____ () C:\Users\Justus\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-05-06 18:43 - 2014-05-06 18:43 - 00001274 _____ () C:\Users\Justus\Desktop\Revo Uninstaller.lnk
2014-05-06 18:43 - 2014-05-06 18:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-06 18:42 - 2014-05-06 18:42 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Justus\Downloads\revosetup95.exe
2014-05-04 23:38 - 2014-05-05 10:38 - 00047919 _____ () C:\Users\Justus\Downloads\Addition.txt
2014-05-04 23:37 - 2014-05-06 21:51 - 00018571 _____ () C:\Users\Justus\Downloads\FRST.txt
2014-05-04 23:37 - 2014-05-06 21:51 - 00000000 ____D () C:\FRST
2014-05-04 23:36 - 2014-05-06 21:51 - 02063872 _____ (Farbar) C:\Users\Justus\Downloads\FRST64.exe
2014-05-04 23:00 - 2014-05-04 23:00 - 00000000 ____D () C:\Program Files (x86)\Rr Savings
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Program Files (x86)\ConstaSurf
2014-05-04 22:58 - 2012-07-25 12:03 - 00016896 _____ () C:\Windows\system32\sasnative64.exe
2014-05-04 22:57 - 2014-05-06 21:06 - 00001445 _____ () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-03 15:22 - 2014-04-29 18:00 - 23133184 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-03 15:22 - 2014-04-29 17:24 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-03 15:22 - 2014-04-29 16:47 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-03 15:22 - 2014-04-29 16:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-01 23:42 - 2014-05-01 23:48 - 00000000 ____D () C:\Users\Justus\Desktop\UF-Text
2014-04-28 23:12 - 2014-04-28 23:12 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard
2014-04-28 23:06 - 2014-04-28 23:12 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-28 23:06 - 2014-04-28 23:06 - 00001167 _____ () C:\Users\Public\Desktop\Hearthstone.lnk
2014-04-28 23:06 - 2014-04-28 23:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-04-28 22:43 - 2014-05-02 11:31 - 00000000 ____D () C:\Users\Justus\AppData\Local\Battle.net
2014-04-28 22:43 - 2014-05-02 11:30 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-28 22:43 - 2014-04-28 23:06 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00001130 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard Entertainment
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-04-28 22:40 - 2014-04-28 22:40 - 07094224 _____ (Blizzard Entertainment) C:\Users\Justus\Downloads\Hearthstone-Setup-deDE.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00000000 ____D () C:\ProgramData\Battle.net
2014-04-23 15:06 - 2014-04-28 14:01 - 00000000 ____D () C:\Users\Justus\Desktop\Stiendium
2014-04-23 12:30 - 2014-04-23 12:30 - 00316160 _____ (Dropbox, Inc.) C:\Users\Justus\Downloads\DropboxInstaller (1).exe
2014-04-22 23:44 - 2014-04-22 23:44 - 00001499 _____ () C:\Users\Justus\.recently-used.xbel
2014-04-18 17:02 - 2014-04-18 17:04 - 00009843 _____ () C:\Users\Justus\Desktop\Sammlung.txt
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-04-15 00:14 - 2014-04-15 00:14 - 01070496 _____ (Unity Technologies ApS) C:\Users\Justus\Downloads\UnityWebPlayer.exe
2014-04-15 00:14 - 2014-04-15 00:14 - 00000000 ____D () C:\Users\Justus\AppData\Local\Unity
2014-04-14 13:39 - 2014-05-04 20:45 - 00000000 ____D () C:\Users\Justus\Desktop\Keta-Forum
2014-04-11 20:29 - 2014-04-11 20:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\Users\Justus\AppData\Local\IBM
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\ProgramData\SafeNet Sentinel
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\SPSS
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
2014-04-10 17:30 - 2014-04-10 17:30 - 00000000 ____D () C:\Program Files\Common Files\IBM
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000219 _____ () C:\Windows\SysWOW64\lsprst7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00000205 _____ () C:\Windows\SysWOW64\lsprst7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000016 ____H () C:\Windows\SysWOW64\servdat.slm
2014-04-10 17:29 - 2014-04-10 17:29 - 00000000 ____D () C:\Program Files\IBM
2014-04-10 17:22 - 2014-04-10 17:22 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-04-10 17:21 - 2014-04-10 17:21 - 00000000 ___HD () C:\Users\Justus\InstallAnywhere
2014-04-10 17:20 - 2014-04-10 17:23 - 812131760 _____ (IBM Corp) C:\Users\Justus\Downloads\SPSS_Statistics_22_win64_.exe
2014-04-10 17:17 - 2014-04-10 17:18 - 95156272 _____ (Flexera Software) C:\Users\Justus\Downloads\SPSS_CnDS_50_StatsAdap_22_win64.exe
2014-04-10 13:58 - 2014-04-10 13:58 - 00000845 _____ () C:\Users\Justus\Downloads\vpn-extern.pcf
2014-04-10 13:56 - 2014-04-10 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\ProgramData\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Program Files\ShrewSoft
2014-04-10 13:54 - 2014-04-10 13:55 - 00009171 _____ () C:\install.log
2014-04-10 13:54 - 2014-04-10 13:54 - 03346256 _____ () C:\Users\Justus\Downloads\vpn-client-2.2.2-release.exe
2014-04-09 11:19 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 11:19 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 11:19 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 11:19 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 11:19 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 11:18 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 11:18 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 11:18 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 11:18 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 11:18 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 11:18 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 11:18 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-06 21:51 - 2014-05-06 21:51 - 00000000 ____D () C:\Users\Justus\Downloads\FRST-OlderVersion
2014-05-06 21:51 - 2014-05-04 23:37 - 00018571 _____ () C:\Users\Justus\Downloads\FRST.txt
2014-05-06 21:51 - 2014-05-04 23:37 - 00000000 ____D () C:\FRST
2014-05-06 21:51 - 2014-05-04 23:36 - 02063872 _____ (Farbar) C:\Users\Justus\Downloads\FRST64.exe
2014-05-06 21:46 - 2012-03-24 15:22 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA.job
2014-05-06 21:43 - 2011-09-17 20:37 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-06 21:43 - 2011-09-17 16:05 - 01378311 _____ () C:\Windows\WindowsUpdate.log
2014-05-06 21:19 - 2014-05-06 21:19 - 00000866 _____ () C:\Users\Justus\Desktop\JRT.txt
2014-05-06 21:15 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-06 21:15 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-06 21:14 - 2012-04-02 22:16 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-05-06 21:12 - 2014-05-06 21:12 - 00000000 ____D () C:\Windows\ERUNT
2014-05-06 21:11 - 2011-09-17 20:37 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Skype
2014-05-06 21:10 - 2014-05-06 21:11 - 01016261 _____ (Thisisu) C:\Users\Justus\Desktop\JRT.exe
2014-05-06 21:10 - 2014-05-06 21:10 - 01016261 _____ (Thisisu) C:\Users\Justus\Downloads\JRT.exe
2014-05-06 21:10 - 2013-09-03 22:28 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Spotify
2014-05-06 21:06 - 2014-05-06 21:06 - 00015925 _____ () C:\Users\Justus\Desktop\AdwCleaner[S0].txt
2014-05-06 21:06 - 2014-05-04 22:57 - 00001445 _____ () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-06 21:06 - 2013-05-23 19:13 - 00000000 ____D () C:\Users\Justus\AppData\Local\LogMeIn Hamachi
2014-05-06 21:05 - 2011-09-17 20:37 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-06 21:04 - 2010-11-21 05:47 - 00326232 _____ () C:\Windows\PFRO.log
2014-05-06 21:04 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-06 21:04 - 2009-07-14 06:51 - 00327470 _____ () C:\Windows\setupact.log
2014-05-06 21:02 - 2014-05-06 20:52 - 00000000 ____D () C:\AdwCleaner
2014-05-06 20:58 - 2011-09-17 16:13 - 00000000 ___RD () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-06 20:53 - 2012-03-31 10:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-06 20:51 - 2014-05-06 20:50 - 01316991 _____ () C:\Users\Justus\Desktop\adwcleaner.exe
2014-05-06 20:50 - 2014-05-06 20:50 - 00000262 _____ () C:\Users\Justus\Desktop\mbam.txt
2014-05-06 20:48 - 2014-05-06 20:42 - 00002279 _____ () C:\Users\Justus\Desktop\Neues Textdokument.txt
2014-05-06 20:47 - 2014-05-06 19:20 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-06 20:46 - 2012-03-24 15:22 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core.job
2014-05-06 19:20 - 2014-05-06 19:20 - 00001112 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-06 19:20 - 2014-05-06 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-06 19:20 - 2014-05-06 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-06 19:19 - 2014-05-06 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-06 19:18 - 2014-05-06 19:18 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Justus\Desktop\mbam-setup-2.0.1.1004.exe
2014-05-06 18:53 - 2014-05-06 18:53 - 00000050 _____ () C:\Users\Justus\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-05-06 18:43 - 2014-05-06 18:43 - 00001274 _____ () C:\Users\Justus\Desktop\Revo Uninstaller.lnk
2014-05-06 18:43 - 2014-05-06 18:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-06 18:42 - 2014-05-06 18:42 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Justus\Downloads\revosetup95.exe
2014-05-06 18:35 - 2014-01-12 13:41 - 00000000 ____D () C:\Users\Justus\Documents\Citavi 4
2014-05-06 09:33 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-05-06 09:33 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-05-06 09:33 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-05 21:32 - 2011-09-17 22:18 - 00000000 ____D () C:\Users\Justus\AppData\Local\PMB Files
2014-05-05 20:15 - 2012-01-26 00:11 - 00000000 ____D () C:\Users\Justus\Desktop\E-Dokumente
2014-05-05 15:26 - 2013-09-03 22:28 - 00000000 ____D () C:\Users\Justus\AppData\Local\Spotify
2014-05-05 10:38 - 2014-05-04 23:38 - 00047919 _____ () C:\Users\Justus\Downloads\Addition.txt
2014-05-04 23:00 - 2014-05-04 23:00 - 00000000 ____D () C:\Program Files (x86)\Rr Savings
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Program Files (x86)\ConstaSurf
2014-05-04 20:45 - 2014-04-14 13:39 - 00000000 ____D () C:\Users\Justus\Desktop\Keta-Forum
2014-05-04 20:41 - 2012-03-24 15:22 - 00004096 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA
2014-05-04 20:41 - 2012-03-24 15:22 - 00003700 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core
2014-05-04 19:44 - 2014-01-16 11:17 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Dropbox
2014-05-03 14:45 - 2013-09-24 21:51 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\TS3Client
2014-05-02 11:31 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Battle.net
2014-05-02 11:30 - 2014-04-28 22:43 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-05-01 23:48 - 2014-05-01 23:42 - 00000000 ____D () C:\Users\Justus\Desktop\UF-Text
2014-05-01 23:27 - 2012-01-03 22:31 - 00000000 ____D () C:\Users\Justus\Desktop\texte
2014-04-30 13:18 - 2011-11-23 18:41 - 00666112 ___SH () C:\Users\Justus\Downloads\Thumbs.db
2014-04-29 18:00 - 2014-05-03 15:22 - 23133184 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 17:24 - 2014-05-03 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 16:47 - 2014-05-03 15:22 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 16:14 - 2014-05-03 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 08:41 - 2011-09-17 22:18 - 00000000 ____D () C:\ProgramData\PMB Files
2014-04-28 23:12 - 2014-04-28 23:12 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard
2014-04-28 23:12 - 2014-04-28 23:06 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-28 23:06 - 2014-04-28 23:06 - 00001167 _____ () C:\Users\Public\Desktop\Hearthstone.lnk
2014-04-28 23:06 - 2014-04-28 23:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-04-28 23:06 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00001130 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard Entertainment
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-04-28 22:40 - 2014-04-28 22:40 - 07094224 _____ (Blizzard Entertainment) C:\Users\Justus\Downloads\Hearthstone-Setup-deDE.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00000000 ____D () C:\ProgramData\Battle.net
2014-04-28 21:55 - 2012-03-31 10:18 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 21:55 - 2012-03-31 10:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 21:55 - 2011-09-18 04:42 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 14:01 - 2014-04-23 15:06 - 00000000 ____D () C:\Users\Justus\Desktop\Stiendium
2014-04-26 19:42 - 2014-03-28 16:16 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Arc
2014-04-24 15:12 - 2013-12-28 13:50 - 00000000 ____D () C:\Users\Justus\AppData\Local\Akamai
2014-04-23 15:55 - 2014-01-16 11:19 - 00000000 ___RD () C:\Users\Justus\Dropbox
2014-04-23 12:31 - 2014-01-16 11:19 - 00001029 _____ () C:\Users\Justus\Desktop\Dropbox.lnk
2014-04-23 12:31 - 2014-01-16 11:17 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-23 12:30 - 2014-04-23 12:30 - 00316160 _____ (Dropbox, Inc.) C:\Users\Justus\Downloads\DropboxInstaller (1).exe
2014-04-22 23:44 - 2014-04-22 23:44 - 00001499 _____ () C:\Users\Justus\.recently-used.xbel
2014-04-22 23:44 - 2011-11-17 23:44 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\gtk-2.0
2014-04-22 23:44 - 2011-11-17 23:35 - 00000000 ____D () C:\Users\Justus\.gimp-2.6
2014-04-22 23:44 - 2011-09-17 16:13 - 00000000 ____D () C:\Users\Justus
2014-04-22 18:13 - 2013-12-20 11:51 - 00000000 ____D () C:\Users\Justus\Desktop\1UNIDUE
2014-04-22 14:54 - 2013-11-03 18:33 - 00000000 ____D () C:\Users\Justus\Desktop\Gutes_Zeug_Listen
2014-04-18 17:04 - 2014-04-18 17:02 - 00009843 _____ () C:\Users\Justus\Desktop\Sammlung.txt
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-04-16 14:57 - 2014-02-27 16:34 - 00000932 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-04-16 09:30 - 2012-03-17 11:39 - 00000000 ____D () C:\Users\Justus\Desktop\Wolfsträume
2014-04-16 09:30 - 2011-10-10 15:47 - 00000000 ____D () C:\Users\Justus\Desktop\rp
2014-04-16 09:29 - 2011-12-04 17:26 - 00000000 ____D () C:\Users\Justus\Desktop\Unterortner
2014-04-16 09:29 - 2011-09-17 20:47 - 00000000 ____D () C:\Users\Justus\Desktop\spiele
2014-04-15 00:14 - 2014-04-15 00:14 - 01070496 _____ (Unity Technologies ApS) C:\Users\Justus\Downloads\UnityWebPlayer.exe
2014-04-15 00:14 - 2014-04-15 00:14 - 00000000 ____D () C:\Users\Justus\AppData\Local\Unity
2014-04-14 15:38 - 2013-03-15 14:09 - 00000000 ____D () C:\Users\Justus\Desktop\Spiel
2014-04-12 10:27 - 2012-06-14 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-11 20:30 - 2014-04-11 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\Users\Justus\AppData\Local\IBM
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\ProgramData\SafeNet Sentinel
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\SPSS
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
2014-04-10 17:30 - 2014-04-10 17:30 - 00000000 ____D () C:\Program Files\Common Files\IBM
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000219 _____ () C:\Windows\SysWOW64\lsprst7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00000205 _____ () C:\Windows\SysWOW64\lsprst7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000016 ____H () C:\Windows\SysWOW64\servdat.slm
2014-04-10 17:29 - 2014-04-10 17:29 - 00000000 ____D () C:\Program Files\IBM
2014-04-10 17:23 - 2014-04-10 17:20 - 812131760 _____ (IBM Corp) C:\Users\Justus\Downloads\SPSS_Statistics_22_win64_.exe
2014-04-10 17:22 - 2014-04-10 17:22 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-04-10 17:21 - 2014-04-10 17:21 - 00000000 ___HD () C:\Users\Justus\InstallAnywhere
2014-04-10 17:18 - 2014-04-10 17:17 - 95156272 _____ (Flexera Software) C:\Users\Justus\Downloads\SPSS_CnDS_50_StatsAdap_22_win64.exe
2014-04-10 14:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 13:58 - 2014-04-10 13:58 - 00000845 _____ () C:\Users\Justus\Downloads\vpn-extern.pcf
2014-04-10 13:56 - 2014-04-10 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\ProgramData\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Program Files\ShrewSoft
2014-04-10 13:55 - 2014-04-10 13:54 - 00009171 _____ () C:\install.log
2014-04-10 13:54 - 2014-04-10 13:54 - 03346256 _____ () C:\Users\Justus\Downloads\vpn-client-2.2.2-release.exe
2014-04-10 11:08 - 2011-11-15 18:35 - 00000000 ____D () C:\Users\Justus\AppData\Local\Mozilla
2014-04-09 14:00 - 2011-10-03 17:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 13:59 - 2013-07-15 14:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 13:57 - 2011-09-30 08:18 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Justus\AppData\Local\Temp\032939rr.exe
C:\Users\Justus\AppData\Local\Temp\6_Offer_12.exe
C:\Users\Justus\AppData\Local\Temp\ApnStub.exe
C:\Users\Justus\AppData\Local\Temp\AskSLib.dll
C:\Users\Justus\AppData\Local\Temp\BackupSetup.exe
C:\Users\Justus\AppData\Local\Temp\bdfilters.dll
C:\Users\Justus\AppData\Local\Temp\CmdLineExt.dll
C:\Users\Justus\AppData\Local\Temp\CmdLineExt03.dll
C:\Users\Justus\AppData\Local\Temp\comver.dll
C:\Users\Justus\AppData\Local\Temp\contentDATs.exe
C:\Users\Justus\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Justus\AppData\Local\Temp\drm_dyndata_7330017.dll
C:\Users\Justus\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Justus\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuekmt2.dll
C:\Users\Justus\AppData\Local\Temp\GoogleToolbarInstaller.exe
C:\Users\Justus\AppData\Local\Temp\gtapi.dll
C:\Users\Justus\AppData\Local\Temp\installhelper.dll
C:\Users\Justus\AppData\Local\Temp\instloffer.exe
C:\Users\Justus\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Justus\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Justus\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe
C:\Users\Justus\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Justus\AppData\Local\Temp\NGMDll.dll
C:\Users\Justus\AppData\Local\Temp\NGMResource.dll
C:\Users\Justus\AppData\Local\Temp\NGMSetup.exe
C:\Users\Justus\AppData\Local\Temp\Quarantine.exe
C:\Users\Justus\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Justus\AppData\Local\Temp\Shortcut_Shortcut_sweetimsetup.exe
C:\Users\Justus\AppData\Local\Temp\Shortcut_sweetimsetup.exe
C:\Users\Justus\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Justus\AppData\Local\Temp\SIntf16.dll
C:\Users\Justus\AppData\Local\Temp\SIntf32.dll
C:\Users\Justus\AppData\Local\Temp\SIntfNT.dll
C:\Users\Justus\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Justus\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Justus\AppData\Local\Temp\SRLDetectionLibrary7949106527364205144.dll
C:\Users\Justus\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Justus\AppData\Local\Temp\ubiD60D.tmp.exe
C:\Users\Justus\AppData\Local\Temp\unicows.dll
C:\Users\Justus\AppData\Local\Temp\_is673.exe
C:\Users\Justus\AppData\Local\Temp\_is6F8F.exe
C:\Users\Justus\AppData\Local\Temp\_isB053.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 12:38

==================== End Of Log ============================
--- --- ---

--- --- ---


Das sollte alles sein.
Gruß N

schrauber 07.05.2014 13:32

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Nujakan 08.05.2014 07:20
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=d1e73302db9dbe4bbd551653b31abbc9
# engine=18171
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-07 10:33:13
# local_time=2014-05-08 12:33:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 97975 151131843 0 0
# scanned=393085
# found=1
# cleaned=0
# scan_time=16153
sh=6B9ECC26AED441D42156DBB3C73D290891A98919 ft=1 fh=2e9072869a9ddf52 vn="Win32/Adware.1ClickDownload.W Anwendung" ac=I fn="C:\Users\Justus\Downloads\fast_six.exe"
Code:
Results of screen317's Security Check version 0.99.82 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 JavaFX 2.1.1   
 Java(TM) 6 Update 22 
 Java(TM) 7 Update 5 
 Java version out of Date!
 Adobe Flash Player 13.0.0.206 
 Adobe Reader 10.1.9 Adobe Reader out of Date! 
 Mozilla Firefox (28.0)
 Google Chrome 34.0.1847.116 
 Google Chrome 34.0.1847.131 
````````Process Check: objlist.exe by Laurent```````` 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2014
Ran by Justus (administrator) on JUSTUS-PC on 08-05-2014 08:16:15
Running from C:\Users\Justus\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Realtek Semiconductor) C:\Windows\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spotify Ltd) C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Akamai Technologies, Inc.) C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Akamai Technologies, Inc.) C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
() C:\Program Files\ShrewSoft\VPN Client\iked.exe
() C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Perfect World Entertainment Inc) C:\Program Files (x86)\Perfect World Entertainment\Arc\Arc.exe
() C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcOSBrowser.exe
(Spotify Ltd) C:\Users\Justus\AppData\Roaming\Spotify\spotify.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\Justus\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RAVCpl64.exe [6297088 2008-05-28] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252296 2012-01-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Aeria Ignite] => C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe [1925656 2013-06-06] (Aeria Games & Entertainment)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-04-15] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Google Update] => C:\Users\Justus\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-03-24] (Google Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Spotify] => C:\Users\Justus\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-08] (Spotify Ltd)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Spotify Web Helper] => C:\Users\Justus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-08] (Spotify Ltd)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Justus\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\Run: [GoogleChromeAutoLaunch_4B58CE89BFB61E88DC2FAC95911F6EFA] => C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.)
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\MountPoints2: {233aaba2-b816-11e2-9849-0008549fe9f1} - E:\Windows\CHECK\DriveNavigator.exe
HKU\S-1-5-21-2227984459-1923807984-2254057487-1000\...\MountPoints2: {7f9a167f-0fc1-11e3-9ef2-003067abfac7} - E:\autorun.exe
Startup: C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEC025D046775CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL =
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class - {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll (Perfect World Entertainment Inc)
BHO-x32: ConstaSurf - {96cf2cbe-b6d5-454a-a62a-84bcda86ef1d} - C:\Program Files (x86)\ConstaSurf\ConstaSurfbho.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\MP3 Skype Recorder\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{C8DC7B6B-C500-463E-ADEE-1A9B04422CE7}: [NameServer]132.252.3.10,132.252.1.7

FireFox:
========
FF ProfilePath: C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin - C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll (Perfect World Entertainment Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @coreonline.com/run3d,version=1.0 - C:\Users\Justus\AppData\LocalLow\Square Enix\nprun3d.dll (Square Enix)
FF Plugin HKCU: @eximion.com/KalydoPlayer - C:\Users\Justus\AppData\Roaming\Kalydo\KalydoPlayer\bin2\npkalydo.dll (Eximion B.V.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Justus\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Justus\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Justus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Zotero - C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\Extensions\zotero@chnm.gmu.edu [2012-08-07]
FF Extension: NoScript - C:\Users\Justus\AppData\Roaming\Mozilla\Firefox\Profiles\y9t5g8z3.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-09-29]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-04-11]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-01-12]

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR StartupUrls: "hxxp://www.spiegel.de/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Justus\AppData\Local\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Extension: (YouTube) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-24]
CHR Extension: (Adblock Plus) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-02-01]
CHR Extension: (Google-Suche) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-24]
CHR Extension: (HTTPS Everywhere) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2012-03-24]
CHR Extension: (AdBlock) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-03-20]
CHR Extension: (Zotero Connector) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\jciblakmllnhbhjjgkbkeihelcndmgnh [2012-04-10]
CHR Extension: (Skype Click to Call) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-03-24]
CHR Extension: (Google Wallet) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Citavi Picker) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio [2014-01-12]
CHR Extension: (Google Mail) - C:\Users\Justus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-24]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2012-01-17]
CHR HKLM-x32\...\Chrome\Extension: [piehhloihgjjiomhieeddiidpekaajio] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Chrome\ChromePicker.crx [2014-01-12]
CHR StartMenuInternet: Google Chrome - C:\Users\Justus\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2014-04-18] (Perfect World Entertainment Inc)
R2 iked; C:\Program Files\ShrewSoft\VPN Client\iked.exe [1127736 2013-07-01] ()
R2 ipsecd; C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe [810808 2013-07-01] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-04-08] (LogMeIn, Inc.)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-28] ()
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [746392 2013-03-20] (Tunngle.net GmbH)
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [X]
S2 yewimmxqbs64; C:\Program Files\002\yewimmxqbs64.exe run options=01100010020000000000000000000000 sourceguid=3A5B3E40-3C96-4F4E-A48D-C161A8B0E1A6 [X]

==================== Drivers (Whitelisted) ====================

R1 BIOS; C:\Windows\system32\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
R1 BIOS; C:\Windows\SysWOW64\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
S3 E100B; C:\Windows\System32\DRIVERS\efe5b32e.sys [192256 2009-06-10] (Intel Corporation)
S3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-06] (Malwarebytes Corporation)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [61736 2014-02-28] (NetFilterSDK.com)
R3 rtl819xpn64; C:\Windows\System32\DRIVERS\rtl819xp.sys [570880 2009-05-18] (Realtek Semiconductor Corporation                          )
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Classic\safedrv.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-08 08:12 - 2014-05-08 08:12 - 00855379 _____ () C:\Users\Justus\Downloads\SecurityCheck.exe
2014-05-08 08:12 - 2014-05-08 08:12 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-08 08:11 - 2014-05-08 08:11 - 02347384 _____ (ESET) C:\Users\Justus\Downloads\esetsmartinstaller_deu (1).exe
2014-05-07 20:01 - 2014-05-07 20:01 - 02347384 _____ (ESET) C:\Users\Justus\Downloads\esetsmartinstaller_deu.exe
2014-05-07 19:30 - 2014-05-07 19:30 - 00035594 _____ () C:\Users\Justus\Downloads\Nachtragshaushalt_2013-14.xlsx
2014-05-07 19:30 - 2014-05-07 19:30 - 00011331 _____ () C:\Users\Justus\Downloads\Anlage4_NHH_1314.xlsx
2014-05-07 14:51 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-07 14:51 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-07 14:51 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-07 14:51 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-07 13:32 - 2014-05-07 13:33 - 238179061 _____ () C:\Users\Justus\Downloads\Statistik für PolitolgInnen_2014_04_17.mp4
2014-05-07 00:26 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-07 00:26 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-07 00:26 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-07 00:26 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-07 00:26 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-07 00:26 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-07 00:26 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-07 00:26 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-07 00:26 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-07 00:26 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-07 00:26 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-07 00:26 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-07 00:26 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-07 00:26 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-07 00:26 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-07 00:26 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-07 00:26 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-07 00:26 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-07 00:26 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-07 00:26 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-07 00:26 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-07 00:26 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-07 00:26 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-07 00:26 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-07 00:26 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-07 00:26 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-07 00:26 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-07 00:26 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-07 00:26 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-07 00:26 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-07 00:26 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-07 00:26 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-07 00:26 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-07 00:26 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-07 00:26 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-07 00:26 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-07 00:26 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-07 00:26 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-07 00:26 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-07 00:26 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-07 00:26 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-07 00:26 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-07 00:26 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-07 00:26 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-07 00:25 - 2014-05-07 00:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 22:02 - 2014-05-06 22:02 - 00000000 ____D () C:\Users\Justus\Desktop\Rattengift
2014-05-06 21:51 - 2014-05-06 21:51 - 00000000 ____D () C:\Users\Justus\Downloads\FRST-OlderVersion
2014-05-06 21:12 - 2014-05-06 21:12 - 00000000 ____D () C:\Windows\ERUNT
2014-05-06 21:10 - 2014-05-06 21:10 - 01016261 _____ (Thisisu) C:\Users\Justus\Downloads\JRT.exe
2014-05-06 20:53 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-06 20:52 - 2014-05-06 21:02 - 00000000 ____D () C:\AdwCleaner
2014-05-06 19:20 - 2014-05-06 20:47 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-06 19:20 - 2014-05-06 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-06 19:19 - 2014-05-06 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-06 19:19 - 2014-05-06 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-06 19:19 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-06 19:19 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-06 19:19 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-06 18:53 - 2014-05-06 18:53 - 00000050 _____ () C:\Users\Justus\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-05-06 18:43 - 2014-05-06 18:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-06 18:42 - 2014-05-06 18:42 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Justus\Downloads\revosetup95.exe
2014-05-06 18:09 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 18:09 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-04 23:38 - 2014-05-05 10:38 - 00047919 _____ () C:\Users\Justus\Downloads\Addition.txt
2014-05-04 23:37 - 2014-05-08 08:16 - 00019842 _____ () C:\Users\Justus\Downloads\FRST.txt
2014-05-04 23:37 - 2014-05-08 08:16 - 00000000 ____D () C:\FRST
2014-05-04 23:36 - 2014-05-06 21:51 - 02063872 _____ (Farbar) C:\Users\Justus\Downloads\FRST64.exe
2014-05-04 23:00 - 2014-05-04 23:00 - 00000000 ____D () C:\Program Files (x86)\Rr Savings
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Program Files (x86)\ConstaSurf
2014-05-04 22:58 - 2012-07-25 12:03 - 00016896 _____ () C:\Windows\system32\sasnative64.exe
2014-05-04 22:57 - 2014-05-06 21:06 - 00001445 _____ () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-01 23:42 - 2014-05-01 23:48 - 00000000 ____D () C:\Users\Justus\Desktop\UF-Text
2014-04-28 23:12 - 2014-04-28 23:12 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard
2014-04-28 23:06 - 2014-04-28 23:12 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-28 23:06 - 2014-04-28 23:06 - 00001167 _____ () C:\Users\Public\Desktop\Hearthstone.lnk
2014-04-28 23:06 - 2014-04-28 23:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-04-28 22:43 - 2014-05-02 11:31 - 00000000 ____D () C:\Users\Justus\AppData\Local\Battle.net
2014-04-28 22:43 - 2014-05-02 11:30 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-28 22:43 - 2014-04-28 23:06 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00001130 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard Entertainment
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-04-28 22:40 - 2014-04-28 22:40 - 07094224 _____ (Blizzard Entertainment) C:\Users\Justus\Downloads\Hearthstone-Setup-deDE.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00000000 ____D () C:\ProgramData\Battle.net
2014-04-23 15:06 - 2014-04-28 14:01 - 00000000 ____D () C:\Users\Justus\Desktop\Stiendium
2014-04-23 12:30 - 2014-04-23 12:30 - 00316160 _____ (Dropbox, Inc.) C:\Users\Justus\Downloads\DropboxInstaller (1).exe
2014-04-22 23:44 - 2014-04-22 23:44 - 00001499 _____ () C:\Users\Justus\.recently-used.xbel
2014-04-18 17:02 - 2014-04-18 17:04 - 00009843 _____ () C:\Users\Justus\Desktop\Sammlung.txt
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-04-15 00:14 - 2014-04-15 00:14 - 01070496 _____ (Unity Technologies ApS) C:\Users\Justus\Downloads\UnityWebPlayer.exe
2014-04-15 00:14 - 2014-04-15 00:14 - 00000000 ____D () C:\Users\Justus\AppData\Local\Unity
2014-04-14 13:39 - 2014-05-07 10:46 - 00000000 ____D () C:\Users\Justus\Desktop\Keta-Forum
2014-04-11 20:29 - 2014-04-11 20:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\Users\Justus\AppData\Local\IBM
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\ProgramData\SafeNet Sentinel
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\SPSS
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
2014-04-10 17:30 - 2014-04-10 17:30 - 00000000 ____D () C:\Program Files\Common Files\IBM
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000219 _____ () C:\Windows\SysWOW64\lsprst7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00000205 _____ () C:\Windows\SysWOW64\lsprst7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000016 ____H () C:\Windows\SysWOW64\servdat.slm
2014-04-10 17:29 - 2014-04-10 17:29 - 00000000 ____D () C:\Program Files\IBM
2014-04-10 17:22 - 2014-04-10 17:22 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-04-10 17:21 - 2014-04-10 17:21 - 00000000 ___HD () C:\Users\Justus\InstallAnywhere
2014-04-10 17:20 - 2014-04-10 17:23 - 812131760 _____ (IBM Corp) C:\Users\Justus\Downloads\SPSS_Statistics_22_win64_.exe
2014-04-10 17:17 - 2014-04-10 17:18 - 95156272 _____ (Flexera Software) C:\Users\Justus\Downloads\SPSS_CnDS_50_StatsAdap_22_win64.exe
2014-04-10 13:58 - 2014-04-10 13:58 - 00000845 _____ () C:\Users\Justus\Downloads\vpn-extern.pcf
2014-04-10 13:56 - 2014-04-10 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\ProgramData\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Program Files\ShrewSoft
2014-04-10 13:54 - 2014-04-10 13:55 - 00009171 _____ () C:\install.log
2014-04-10 13:54 - 2014-04-10 13:54 - 03346256 _____ () C:\Users\Justus\Downloads\vpn-client-2.2.2-release.exe
2014-04-09 11:19 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 11:19 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 11:19 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 11:19 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 11:19 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 11:18 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 11:18 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 11:18 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 11:18 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 11:18 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 11:18 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 11:18 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 11:18 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-08 08:17 - 2014-05-04 23:37 - 00019842 _____ () C:\Users\Justus\Downloads\FRST.txt
2014-05-08 08:16 - 2014-05-04 23:37 - 00000000 ____D () C:\FRST
2014-05-08 08:15 - 2011-09-17 20:37 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Skype
2014-05-08 08:12 - 2014-05-08 08:12 - 00855379 _____ () C:\Users\Justus\Downloads\SecurityCheck.exe
2014-05-08 08:12 - 2014-05-08 08:12 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-08 08:11 - 2014-05-08 08:11 - 02347384 _____ (ESET) C:\Users\Justus\Downloads\esetsmartinstaller_deu (1).exe
2014-05-08 08:07 - 2013-09-03 22:28 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Spotify
2014-05-08 08:03 - 2009-07-14 06:51 - 00328254 _____ () C:\Windows\setupact.log
2014-05-08 08:00 - 2012-03-24 15:22 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA.job
2014-05-08 08:00 - 2011-09-17 20:37 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-08 07:59 - 2012-03-31 10:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-08 00:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-08 00:05 - 2014-01-12 13:41 - 00000000 ____D () C:\Users\Justus\Documents\Citavi 4
2014-05-07 23:57 - 2011-09-17 22:18 - 00000000 ____D () C:\Users\Justus\AppData\Local\PMB Files
2014-05-07 23:57 - 2011-09-17 22:18 - 00000000 ____D () C:\ProgramData\PMB Files
2014-05-07 21:19 - 2011-09-17 16:05 - 01455960 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 21:14 - 2011-11-23 18:41 - 00694784 ___SH () C:\Users\Justus\Downloads\Thumbs.db
2014-05-07 20:46 - 2012-03-24 15:22 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core.job
2014-05-07 20:38 - 2012-03-17 11:39 - 00000000 ____D () C:\Users\Justus\Desktop\Wolfsträume
2014-05-07 20:01 - 2014-05-07 20:01 - 02347384 _____ (ESET) C:\Users\Justus\Downloads\esetsmartinstaller_deu.exe
2014-05-07 19:48 - 2011-09-17 20:37 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-07 19:43 - 2011-09-17 20:37 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-07 19:43 - 2011-09-17 20:37 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-07 19:30 - 2014-05-07 19:30 - 00035594 _____ () C:\Users\Justus\Downloads\Nachtragshaushalt_2013-14.xlsx
2014-05-07 19:30 - 2014-05-07 19:30 - 00011331 _____ () C:\Users\Justus\Downloads\Anlage4_NHH_1314.xlsx
2014-05-07 19:26 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-07 19:26 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-07 19:17 - 2013-09-03 22:28 - 00000000 ____D () C:\Users\Justus\AppData\Local\Spotify
2014-05-07 19:15 - 2013-05-23 19:13 - 00000000 ____D () C:\Users\Justus\AppData\Local\LogMeIn Hamachi
2014-05-07 19:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-07 13:33 - 2014-05-07 13:32 - 238179061 _____ () C:\Users\Justus\Downloads\Statistik für PolitolgInnen_2014_04_17.mp4
2014-05-07 11:50 - 2013-12-20 11:51 - 00000000 ____D () C:\Users\Justus\Desktop\1UNIDUE
2014-05-07 10:46 - 2014-04-14 13:39 - 00000000 ____D () C:\Users\Justus\Desktop\Keta-Forum
2014-05-07 09:37 - 2012-01-26 00:11 - 00000000 ____D () C:\Users\Justus\Desktop\E-Dokumente
2014-05-07 09:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-07 00:25 - 2014-05-07 00:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 23:47 - 2013-09-24 21:51 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\TS3Client
2014-05-06 22:02 - 2014-05-06 22:02 - 00000000 ____D () C:\Users\Justus\Desktop\Rattengift
2014-05-06 21:51 - 2014-05-06 21:51 - 00000000 ____D () C:\Users\Justus\Downloads\FRST-OlderVersion
2014-05-06 21:51 - 2014-05-04 23:36 - 02063872 _____ (Farbar) C:\Users\Justus\Downloads\FRST64.exe
2014-05-06 21:14 - 2012-04-02 22:16 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-05-06 21:12 - 2014-05-06 21:12 - 00000000 ____D () C:\Windows\ERUNT
2014-05-06 21:10 - 2014-05-06 21:10 - 01016261 _____ (Thisisu) C:\Users\Justus\Downloads\JRT.exe
2014-05-06 21:06 - 2014-05-04 22:57 - 00001445 _____ () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-06 21:04 - 2010-11-21 05:47 - 00326232 _____ () C:\Windows\PFRO.log
2014-05-06 21:02 - 2014-05-06 20:52 - 00000000 ____D () C:\AdwCleaner
2014-05-06 20:58 - 2011-09-17 16:13 - 00000000 ___RD () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-06 20:47 - 2014-05-06 19:20 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-06 19:20 - 2014-05-06 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-06 19:20 - 2014-05-06 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-06 19:19 - 2014-05-06 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-06 18:53 - 2014-05-06 18:53 - 00000050 _____ () C:\Users\Justus\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2014-05-06 18:43 - 2014-05-06 18:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-06 18:42 - 2014-05-06 18:42 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Justus\Downloads\revosetup95.exe
2014-05-06 09:33 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-05-06 09:33 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-05-06 09:33 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-05 10:38 - 2014-05-04 23:38 - 00047919 _____ () C:\Users\Justus\Downloads\Addition.txt
2014-05-04 23:00 - 2014-05-04 23:00 - 00000000 ____D () C:\Program Files (x86)\Rr Savings
2014-05-04 22:58 - 2014-05-04 22:58 - 00000000 ____D () C:\Program Files (x86)\ConstaSurf
2014-05-04 20:41 - 2012-03-24 15:22 - 00004096 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000UA
2014-05-04 20:41 - 2012-03-24 15:22 - 00003700 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2227984459-1923807984-2254057487-1000Core
2014-05-04 19:44 - 2014-01-16 11:17 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Dropbox
2014-05-02 11:31 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Battle.net
2014-05-02 11:30 - 2014-04-28 22:43 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-05-01 23:48 - 2014-05-01 23:42 - 00000000 ____D () C:\Users\Justus\Desktop\UF-Text
2014-05-01 23:27 - 2012-01-03 22:31 - 00000000 ____D () C:\Users\Justus\Desktop\texte
2014-04-29 16:01 - 2014-05-07 14:51 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-07 14:51 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-07 14:51 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-07 14:51 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-28 23:12 - 2014-04-28 23:12 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard
2014-04-28 23:12 - 2014-04-28 23:06 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-28 23:06 - 2014-04-28 23:06 - 00001167 _____ () C:\Users\Public\Desktop\Hearthstone.lnk
2014-04-28 23:06 - 2014-04-28 23:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-04-28 23:06 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00001130 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\Users\Justus\AppData\Local\Blizzard Entertainment
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-04-28 22:43 - 2014-04-28 22:43 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-04-28 22:40 - 2014-04-28 22:40 - 07094224 _____ (Blizzard Entertainment) C:\Users\Justus\Downloads\Hearthstone-Setup-deDE.exe
2014-04-28 22:40 - 2014-04-28 22:40 - 00000000 ____D () C:\ProgramData\Battle.net
2014-04-28 21:55 - 2012-03-31 10:18 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 21:55 - 2012-03-31 10:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 21:55 - 2011-09-18 04:42 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 14:01 - 2014-04-23 15:06 - 00000000 ____D () C:\Users\Justus\Desktop\Stiendium
2014-04-26 19:42 - 2014-03-28 16:16 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Arc
2014-04-24 15:12 - 2013-12-28 13:50 - 00000000 ____D () C:\Users\Justus\AppData\Local\Akamai
2014-04-23 15:55 - 2014-01-16 11:19 - 00000000 ___RD () C:\Users\Justus\Dropbox
2014-04-23 12:31 - 2014-01-16 11:19 - 00001029 _____ () C:\Users\Justus\Desktop\Dropbox.lnk
2014-04-23 12:31 - 2014-01-16 11:17 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-23 12:30 - 2014-04-23 12:30 - 00316160 _____ (Dropbox, Inc.) C:\Users\Justus\Downloads\DropboxInstaller (1).exe
2014-04-22 23:44 - 2014-04-22 23:44 - 00001499 _____ () C:\Users\Justus\.recently-used.xbel
2014-04-22 23:44 - 2011-11-17 23:44 - 00000000 ____D () C:\Users\Justus\AppData\Roaming\gtk-2.0
2014-04-22 23:44 - 2011-11-17 23:35 - 00000000 ____D () C:\Users\Justus\.gimp-2.6
2014-04-22 23:44 - 2011-09-17 16:13 - 00000000 ____D () C:\Users\Justus
2014-04-22 14:54 - 2013-11-03 18:33 - 00000000 ____D () C:\Users\Justus\Desktop\Gutes_Zeug_Listen
2014-04-18 17:04 - 2014-04-18 17:02 - 00009843 _____ () C:\Users\Justus\Desktop\Sammlung.txt
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-04-16 14:57 - 2014-04-16 14:57 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-04-16 14:57 - 2014-02-27 16:34 - 00000932 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-04-16 09:30 - 2011-10-10 15:47 - 00000000 ____D () C:\Users\Justus\Desktop\rp
2014-04-16 09:29 - 2011-12-04 17:26 - 00000000 ____D () C:\Users\Justus\Desktop\Unterortner
2014-04-16 09:29 - 2011-09-17 20:47 - 00000000 ____D () C:\Users\Justus\Desktop\spiele
2014-04-15 00:14 - 2014-04-15 00:14 - 01070496 _____ (Unity Technologies ApS) C:\Users\Justus\Downloads\UnityWebPlayer.exe
2014-04-15 00:14 - 2014-04-15 00:14 - 00000000 ____D () C:\Users\Justus\AppData\Local\Unity
2014-04-14 15:38 - 2013-03-15 14:09 - 00000000 ____D () C:\Users\Justus\Desktop\Spiel
2014-04-14 04:24 - 2014-05-06 18:09 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-06 18:09 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-04-12 10:27 - 2012-06-14 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-11 20:30 - 2014-04-11 20:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\Users\Justus\AppData\Local\IBM
2014-04-10 17:32 - 2014-04-10 17:32 - 00000000 ____D () C:\ProgramData\SafeNet Sentinel
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\SPSS
2014-04-10 17:31 - 2014-04-10 17:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
2014-04-10 17:30 - 2014-04-10 17:30 - 00000000 ____D () C:\Program Files\Common Files\IBM
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00001025 _____ () C:\Windows\SysWOW64\sysprs7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000219 _____ () C:\Windows\SysWOW64\lsprst7.tgz
2014-04-10 17:29 - 2014-04-10 17:29 - 00000205 _____ () C:\Windows\SysWOW64\lsprst7.dll
2014-04-10 17:29 - 2014-04-10 17:29 - 00000016 ____H () C:\Windows\SysWOW64\servdat.slm
2014-04-10 17:29 - 2014-04-10 17:29 - 00000000 ____D () C:\Program Files\IBM
2014-04-10 17:23 - 2014-04-10 17:20 - 812131760 _____ (IBM Corp) C:\Users\Justus\Downloads\SPSS_Statistics_22_win64_.exe
2014-04-10 17:22 - 2014-04-10 17:22 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-04-10 17:21 - 2014-04-10 17:21 - 00000000 ___HD () C:\Users\Justus\InstallAnywhere
2014-04-10 17:18 - 2014-04-10 17:17 - 95156272 _____ (Flexera Software) C:\Users\Justus\Downloads\SPSS_CnDS_50_StatsAdap_22_win64.exe
2014-04-10 13:58 - 2014-04-10 13:58 - 00000845 _____ () C:\Users\Justus\Downloads\vpn-extern.pcf
2014-04-10 13:56 - 2014-04-10 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Users\Justus\AppData\Local\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\ProgramData\Shrew Soft VPN
2014-04-10 13:55 - 2014-04-10 13:55 - 00000000 ____D () C:\Program Files\ShrewSoft
2014-04-10 13:55 - 2014-04-10 13:54 - 00009171 _____ () C:\install.log
2014-04-10 13:54 - 2014-04-10 13:54 - 03346256 _____ () C:\Users\Justus\Downloads\vpn-client-2.2.2-release.exe
2014-04-10 11:08 - 2011-11-15 18:35 - 00000000 ____D () C:\Users\Justus\AppData\Local\Mozilla
2014-04-09 14:00 - 2011-10-03 17:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 13:59 - 2013-07-15 14:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 13:57 - 2011-09-30 08:18 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Justus\AppData\Local\Temp\032939rr.exe
C:\Users\Justus\AppData\Local\Temp\6_Offer_12.exe
C:\Users\Justus\AppData\Local\Temp\ApnStub.exe
C:\Users\Justus\AppData\Local\Temp\AskSLib.dll
C:\Users\Justus\AppData\Local\Temp\BackupSetup.exe
C:\Users\Justus\AppData\Local\Temp\bdfilters.dll
C:\Users\Justus\AppData\Local\Temp\CmdLineExt.dll
C:\Users\Justus\AppData\Local\Temp\CmdLineExt03.dll
C:\Users\Justus\AppData\Local\Temp\comver.dll
C:\Users\Justus\AppData\Local\Temp\contentDATs.exe
C:\Users\Justus\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Justus\AppData\Local\Temp\drm_dyndata_7330017.dll
C:\Users\Justus\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Justus\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuekmt2.dll
C:\Users\Justus\AppData\Local\Temp\GoogleToolbarInstaller.exe
C:\Users\Justus\AppData\Local\Temp\gtapi.dll
C:\Users\Justus\AppData\Local\Temp\installhelper.dll
C:\Users\Justus\AppData\Local\Temp\instloffer.exe
C:\Users\Justus\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Justus\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Justus\AppData\Local\Temp\jre-7u5-windows-i586-iftw.exe
C:\Users\Justus\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Justus\AppData\Local\Temp\NGMDll.dll
C:\Users\Justus\AppData\Local\Temp\NGMResource.dll
C:\Users\Justus\AppData\Local\Temp\NGMSetup.exe
C:\Users\Justus\AppData\Local\Temp\Quarantine.exe
C:\Users\Justus\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Justus\AppData\Local\Temp\Shortcut_Shortcut_sweetimsetup.exe
C:\Users\Justus\AppData\Local\Temp\Shortcut_sweetimsetup.exe
C:\Users\Justus\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Justus\AppData\Local\Temp\SIntf16.dll
C:\Users\Justus\AppData\Local\Temp\SIntf32.dll
C:\Users\Justus\AppData\Local\Temp\SIntfNT.dll
C:\Users\Justus\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Justus\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Justus\AppData\Local\Temp\SRLDetectionLibrary7949106527364205144.dll
C:\Users\Justus\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Justus\AppData\Local\Temp\ubiD60D.tmp.exe
C:\Users\Justus\AppData\Local\Temp\unicows.dll
C:\Users\Justus\AppData\Local\Temp\_is673.exe
C:\Users\Justus\AppData\Local\Temp\_is6F8F.exe
C:\Users\Justus\AppData\Local\Temp\_isB053.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 12:38

==================== End Of Log ============================
--- --- ---

--- --- ---


So das sollten die angefragten Dateien sein.

Bisher habe ich keine technischen Probleme mehr.

gez. N

schrauber 08.05.2014 16:33
Java und Adobe updaten.


Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Nujakan 09.05.2014 15:25
Ich lass jetzt gleich nochmal Delfix über das System laufen, danach ist alles durch. An dieser Stelle möchte ich auf jeden Fall meinen Dank aussprechen. Ich kann zwar nicht behaupten, das ich gerne wiederkommen möchte (im Sinne von: Ich hätte gerne nie wieder so ein Problem), aber wenn ich ein Problem habe, dann wird das hier der Ort sein, an dem ich nach Hilfe suche.

Vielen vielen Dank für den Support. Es hat alles sauber geklappt und ich bin echt glücklich das es diese Website gibt. Vermutlich eine der besten im Netz.

gez N

schrauber 10.05.2014 11:13
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:03 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131