Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows 7: Virenfund (win32.trojan.* NSIS.Application.*) (https://www.trojaner-board.de/156818-windows-7-virenfund-win32-trojan-nsis-application.html)

Danielll 24.07.2014 12:00
Windows 7: Virenfund (win32.trojan.* NSIS.Application.*)
 
Hallo
Nachdem mein Emailkonto zum senden von Spam benutzt wurde, fand ich mit G data mehrere Viren auf meinem Rechner. Ist es mögliche diese vollständig zu entfernen ohene den Rechner zu formatieren? Anbei die logfiles von g data, Defogger, Frst und Gmer
Vielen dank für eure hilfe im vorraus

G data logfile
Code:
Virenprüfung mit G Data InternetSecurity
Version 25.0.1.4 (11.06.2014)
Virensignaturen vom 24.07.2014
Startzeit: 24.07.2014 09:38:07
Engine(s): Engine A (AVA 24.3311), Engine B (GD 25.3637)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein

Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung auf RootKits...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 24.07.2014 11:47:41
    235457 Dateien überprüft
    9 infizierte Dateien gefunden
    0 verdächtige Dateien gefunden


Objekt: DTHelper.exe
        Pfad: C:\Program Files (x86)\DAEMON Tools Lite
        Status: Datei in Quarantäne verschoben
        Virus: Win32.Trojan.Banki.A (Engine B)

Objekt: nsprotector.js
        Pfad: C:\Program Files (x86)\Mozilla Firefox
        Status: Datei in Quarantäne verschoben
        Virus: Script.Application.SearchProtect.Q (Engine B)

Objekt: Launcher.exe
        Pfad: C:\Windows
        Status: Datei in Quarantäne verschoben
        Virus: Win32.Application.SimplyTech.A (Engine B)

Archiv: AstroburnLite180-0182.exe
        Pfad: C:\Users\egal\AppData\Local\Temp
        Status: Datei in Quarantäne verschoben
        Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
        In Archiv: C:\Users\egal\AppData\Local\Temp\AstroburnLite180-0182.exe
        Status: Virus gefunden
        Virus: NSIS.Application.OpenCandy.B

Archiv: pricealarm.exe
        Pfad: C:\Users\me\AppData\Local\DownloadGuide\Offers
        Status: Datei in Quarantäne verschoben
        Virus: Script.Trojan-Spy.VIS.B (Engine B)
Objekt: data/ff/chrome/content/pricealarm.js
        In Archiv: C:\Users\me\AppData\Local\DownloadGuide\Offers\pricealarm.exe
        Status: Virus gefunden
        Virus: Script.Trojan-Spy.VIS.B

Archiv: DTLite4491-0356.exe
        Pfad: C:\Users\me\AppData\Local\Temp
        Status: Datei in Quarantäne verschoben
        Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
        In Archiv: C:\Users\me\AppData\Local\Temp\DTLite4491-0356.exe
        Status: Virus gefunden
        Virus: NSIS.Application.OpenCandy.B

Archiv: DTLite4471-0333.exe
        Pfad: C:\Users\me\Downloads
        Status: Datei in Quarantäne verschoben
        Virus: Win32.Trojan.Banki.A, NSIS.Application.OpenCandy.B (Engine B)
Objekt: $INSTDIR\DTHelper.exe
        In Archiv: C:\Users\me\Downloads\DTLite4471-0333.exe
        Status: Virus gefunden
        Virus: Win32.Trojan.Banki.A
Objekt: [NSIS].nsi
        In Archiv: C:\Users\me\Downloads\DTLite4471-0333.exe
        Status: Virus gefunden
        Virus: NSIS.Application.OpenCandy.B

Archiv: DTLite4454-0314.exe
        Pfad: D:\backup\programme
        Status: Datei in Quarantäne verschoben
        Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
        In Archiv: D:\backup\programme\DTLite4454-0314.exe
        Status: Virus gefunden
        Virus: NSIS.Application.OpenCandy.B

Archiv: DTLite4461-0327.exe
        Pfad: D:\Users\me\Downloads
        Status: Datei in Quarantäne verschoben
        Virus: NSIS.Application.OpenCandy.B (Engine B)
Objekt: [NSIS].nsi
        In Archiv: D:\Users\me\Downloads\DTLite4461-0327.exe
        Status: Virus gefunden
        Virus: NSIS.Application.OpenCandy.B

Der Zugriff auf die folgenden Dateien wurde verweigert:
D:\betriebssysteme\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt:Zone.Identifier
D:\Users\me\Downloads\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt:Zone.Identifier
C:\Windows\CSC\v2.0.6\pq
C:\Windows\CSC\v2.0.6\temp\ea-{576f94a1-1ee1-11e3-83b0-dc4c348a742b}
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession7.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG2
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat.LOG1
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{255b9507-1f6a-11e3-a132-14feb5c55e8f}.TM.blf
C:\Windows\System32\Microsoft\Protect\Recovery\Recovery.dat{255b9507-1f6a-11e3-a132-14feb5c55e8f}.TMContainer00000000000000000002.regtrans-ms
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0f6f9445a5848657806bcdc71e7e8df2_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\18860b65a58235275844d72e6f9d0e89_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0a77fba3c7e0ac1ff94625556e5c9c41_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1a006425bc1731962d18c73ca2c0afa8_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\273101a01233a07d31a8b462944fe594_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\27c0968e7a336b4751eff1a578c02c53_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\289cae905d2e45ddf9a496cd6b3f7c48_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\367357769c1e297869be08dbfab7e9a7_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\39e541f125bf6b014dd1ef837da1b045_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2ec5a003bc73228206a2e062ccbda4cd_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3e08f3f52cf1d94c53131619f8285e60_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\33d1c2a2ccb98bc7da1b97fcf522088d_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\40f6146ef87bdaeece87929fb6009608_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3b0095f819d55825a4aaffc4fa600822_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4a8d99983ab7c93a15d17899721612f9_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4e66880e2815dcb5f66d6808b80c4706_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4aa8ab302bf8f96804aab031e7eae5c5_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\44934bcb3b034ee949dff7a7b26e0834_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5c2484084f8cc28514d8afea77cd3532_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5b3340cf9f8d0a6c0ea7771f29032ff6_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\62308cbc5b3275e8a5ce02af1fc43cea_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\526e0503eadb53733e0852c251cf08b3_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6583f8a2f9e8a8a93cd8ba823651cbd2_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\662bcfa6b2f921552cb383f47f4fd814_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\62ea08f843e9d90d8cb43a48f356a578_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\69021f6809f6bec031e205a53d40f5cc_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6a76823756172a9f36d7abae16ca4242_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\845fc8ebc7de226db9037dd9e90de9c4_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7e1558601c0b50fe4ae3e0f533ed0866_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6b611d5c3a1df19f80947b81ec503670_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\81811cfde21c1e5bbb0fd873a018a80a_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8cb2dc930042135ef6f6cbeefa6b9dff_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\87ab25eb989f6f6405a024b2e41a195b_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\8c49dc95d1fa6d39c6e983b8ef01e13c_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\92633aa2dcd704c4fe376c0c34901b26_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\906b4506e07d8653afd761ee11d34889_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\90ee6934daf0db731e85033e02eb71a2_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\93009359def1b1ada248fa17579c5cc8_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\95b6c0e1464f0cc23054d236fabd86b4_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a1b1476521dcd48b13ecd33bf627d420_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9e79bd935088ff3facf3b7eacfade697_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a5c4a9b7edc5659081454b388dc0a6bf_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ac24286bc4cb75a46e89f97d9c6c2161_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a6d6524cf5fa818b82052b5c452670ae_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ab808cbc8161288fb3c75f572451b6fb_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b455cb7e25b3fe5a5702abc4c4d4db3f_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b7998e24adee06e1d72c90d3caf89b43_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b46e50ebc98a00de39d6decedbc84c9a_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c3ef1872efcc256ef045fd4561f7a7f5_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b4bbe77e9c674c67ca93d67c189c9b54_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d1f1b0a8c53e2422a000f35347ac2e46_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c46faf8916807c65382b2552c9429c49_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d9aac2075d2a021caa609375cf475328_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c605bfb1a3345c58409aa6be2c27d236_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d58896110ae420ef9461494a4b179936_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\dc1f814b93073e577453c0f58d7c216e_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\db9fab0b5855165812861aeab5160d89_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e49780c04951d46d2c020dea85977efa_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e20dfccc3b8abc7001b88b72982f53ed_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e1033a3bf7513f06f118c5efcbccf24c_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f6ebe4083aff08dc993c755e8169b583_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e865ca644f828aba930a038bff963e45_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f73dfebb5ef912b0301a95731eae2ad5_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fdd601cb5b5cb659a38d9d7fa939b9fe_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f8ab6fed42e5d0ee8d55e9e59854d1c9_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fa36c989541f1402465b1c9645999b2a_2373e354-cf37-44ec-a701-979871415445
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fed214d225fa762cc7c2868b8fb8f02c_2373e354-cf37-44ec-a701-979871415445
C:\System Volume Information\Syscache.hve
C:\System Volume Information\Syscache.hve.LOG2
C:\System Volume Information\MountPointManagerRemoteDatabase
C:\System Volume Information\Syscache.hve.LOG1
D:\betriebssysteme\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt
D:\Users\me\Downloads\iPhone3G_Normal_WD6\__MACOSX\._READ_ME.txt

Die folgenden Dateien sind Passwortgeschützt:
D:\backup\programme\betriebssysteme\ubcd511.iso
D:\betriebssysteme\ubcd511.iso
D:\Users\me\AppData\Local\Adobe\AIH.a973aa170539461b9d48ac9a54f81d01ee53dbe6\downloader.bundle
D:\Users\me\AppData\Local\Adobe\AIH.a973aa170539461b9d48ac9a54f81d01ee53dbe6\launcher.bundle
D:\Users\me\Downloads\WHDCdU1Aa.part1.rar
D:\Users\me\Downloads\dell\R261284.exe
defogger logfile
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:31 on 24/07/2014 (egal)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
First.txt

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by me (ATTENTION: The logged in user is not administrator) on ME-PC on 24-07-2014 12:34:36
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
SearchScopes: HKLM-x32 - DefaultScope {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKCU - DefaultScope {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKCU - {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3297265&CUI=UN28251651208448154&UM=2
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default
FF SearchEngineOrder.1: Web Search
FF Homepage: hxxp://www.zeit.de/index
FF Keyword.URL: hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\me\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FireJump - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\firejump@firejump.net [2013-09-16]
FF Extension: ProxTube - Unblock YouTube - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\ich@maltegoetz.de [2013-12-13]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2013-09-16]
FF Extension: WOT - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-30]
FF Extension: Download Statusbar - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2013-09-16]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\adblockpopups@jessehakanen.net.xpi [2013-09-16]
FF Extension: WebConnect - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\firefox@webconnect.co.xpi [2013-09-16]
FF Extension: Personas Plus - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\personas@christopher.beard.xpi [2013-09-16]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2013-09-16]
FF Extension: NoScript - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-09-16]
FF Extension: FireFTP - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2013-09-16]
FF Extension: Adblock Plus - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-09-16]
FF Extension: Download Statusbar - C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2013-09-16]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-24 12:34 - 2014-07-24 12:35 - 00017375 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-24 12:34 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-06-25 01:15 - 2014-06-25 01:15 - 00000328 _____ () C:\Windows\PFRO.log
2014-06-25 01:12 - 2014-06-25 01:14 - 00000000 ____D () C:\Program Files\Canon
2014-06-25 01:12 - 2012-10-04 00:00 - 00660992 _____ (CANON INC.) C:\Windows\system32\CNAC8EMD.DLL
2014-06-25 01:12 - 2012-09-03 00:00 - 00486400 _____ (CANON INC.) C:\Windows\system32\CNAP2LMD.DLL
2014-06-25 01:12 - 2011-03-08 00:00 - 01289728 _____ (CANON INC.) C:\Windows\system32\CNAP1NSD.DLL
2014-06-25 01:10 - 2014-06-25 01:10 - 00000000 ____D () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1
2014-06-25 01:07 - 2014-06-25 01:08 - 15011392 _____ () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-24 12:35 - 2014-07-24 12:34 - 00017375 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-24 12:34 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:18 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-24 12:18 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-24 12:14 - 2013-09-16 17:20 - 01548661 _____ () C:\Windows\WindowsUpdate.log
2014-07-24 12:11 - 2014-01-23 14:02 - 00003408 _____ () C:\Windows\setupact.log
2014-07-24 12:11 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-24 12:11 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-24 12:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 12:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-24 11:55 - 2014-06-18 06:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:52 - 2014-05-26 16:08 - 00000276 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-06-30 04:09 - 2014-07-09 13:16 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-09 13:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-25 01:15 - 2014-06-25 01:15 - 00000328 _____ () C:\Windows\PFRO.log
2014-06-25 01:14 - 2014-06-25 01:12 - 00000000 ____D () C:\Program Files\Canon
2014-06-25 01:10 - 2014-06-25 01:10 - 00000000 ____D () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1
2014-06-25 01:08 - 2014-06-25 01:07 - 15011392 _____ () C:\Users\me\Downloads\LBP5050_5050N_R150_V110_W64_uk_EN_1.exe

Some content of TEMP:
====================
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
--- --- ---

--- --- ---


Addition.txt
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-07-2014
Ran by me at 2014-07-24 12:35:46
Running from C:\Users\me\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G Data InternetSecurity (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.11.22 - STMicroelectronics)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.05 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Astroburn Lite (HKLM-x32\...\Astroburn Lite) (Version: 1.8.0.0182 - Disc Soft Ltd)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon LBP5050 (HKLM\...\Canon LBP5050) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04072 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072 - Cisco Systems, Inc.) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
Definition Update for Microsoft Office 2013 (KB2760587) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{65480649-2AA6-4C5C-AAE8-DB35335D98A7}) (Version:  - Microsoft)
Dell Digital Delivery (HKLM-x32\...\{D850CB7E-72BC-4510-BA4F-48932BFAB295}) (Version: 2.9.901.0 - Dell Products, LP)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.87 - DivX, LLC)
G Data InternetSecurity (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.4 - G Data Software AG)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.3.1520 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version:  - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.400 - Oracle)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Kalkules 1.9.3.22 (HKLM-x32\...\{6541EA45-0665-4485-ABAA-417BC83AC92F}_is1) (Version:  - Jardo)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 64-bit Components 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visio MUI (German) 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Visio Professional 2013 (HKLM-x32\...\Office15.VISPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visio Professional 2013 (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MultiBit 0.5.15 (HKLM-x32\...\MultiBit 0.5.15) (Version: 0.5.15 - )
No23 Recorder (HKLM-x32\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
NVIDIA 3D Vision Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.7 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.9 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.7 - Pando Networks Inc.)
PC Remote (HKLM-x32\...\{A9364C10-E23A-4598-8B56-790461B983C0}) (Version: 3.48 - PC Remote)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6788 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
Secure Download Manager (HKLM-x32\...\{7709C9B0-AD83-4F7C-A153-B956BC3C3B0A}) (Version: 3.1.10 - Kivuto Solutions Inc.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{8D2E04ED-3350-4ECE-9D6E-3BC9A9A93A47}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation) Hidden
SlimDrivers (HKLM-x32\...\{3CF3DEF4-ED15-4F7B-9320-C3E1081EA4DA}) (Version: 2.2.30877 - SlimWare Utilities, Inc.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.6.1032 - SUPERAntiSpyware.com)
TeXnicCenter Version 2.0 Stable (HKLM-x32\...\TeXnicCenter_is1) (Version: 2.0 Stable - The TeXnicCenter Team)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update for Microsoft Excel 2013 (KB2881085) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{122B0E69-64AF-41BE-B3F6-D387A7E7E687}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2760344) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{A7610F07-E844-4444-8E1D-D5BC8AD0B4C5}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2768012) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{66421820-D3CA-450A-898C-78D7E40108E6}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2826040) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{B7EA8070-C37F-4617-82F4-52CF3304595A}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863843) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{AD7045B8-1D75-4B4C-8120-12F045D206C7}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2863843) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{AD7045B8-1D75-4B4C-8120-12F045D206C7}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880457) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{D27F6360-AE1E-4C8C-8ECD-C0375E20B923}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{5D6439FF-D651-4B13-B52E-2508AB9DE19D}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{5D6439FF-D651-4B13-B52E-2508AB9DE19D}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880464) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{06EF2BF7-7351-4D70-A0D5-588FCCF9808D}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880478) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{7C5CEE0F-6823-4BB7-A28F-76FEC14EB6AC}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880987) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{07017577-FBD6-45E2-A796-659E8F428057}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2880987) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{07017577-FBD6-45E2-A796-659E8F428057}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2881074) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{B23AED0C-4813-4B49-9870-2F0968824E87}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-0407-0000-0000000FF1CE}_Office15.VISPROR_{E249DF0B-9318-47AC-A6C2-A860FF1BEC3C}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-0409-0000-0000000FF1CE}_Office15.VISPROR_{56962EB1-4DD3-48BB-934B-EA4C4516D89A}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-040C-0000-0000000FF1CE}_Office15.VISPROR_{63AED158-0508-4738-A811-840B2053EF3B}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2881084) 32-Bit Edition (HKLM-x32\...\{90150000-001F-0410-0000-0000000FF1CE}_Office15.VISPROR_{AE4413A8-4182-4883-B0BB-AC34CDFB56BC}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2881086) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{02DB183E-6F67-4906-A391-325874C5DA87}) (Version:  - Microsoft)
Update for Microsoft Office 2013 (KB2881086) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{02DB183E-6F67-4906-A391-325874C5DA87}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2881087) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{FC6618D2-F75D-4FDD-B396-E4B0C0D757B6}) (Version:  - Microsoft)
Update for Microsoft OneDrive for Business (KB2881087) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0407-1000-0000000FF1CE}_Office15.VISPROR_{FC6618D2-F75D-4FDD-B396-E4B0C0D757B6}) (Version:  - Microsoft)
Update for Microsoft OneNote 2013 (KB2881082) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{CA0F0611-10FB-47D4-A642-E3BABCC73393}) (Version:  - Microsoft)
Update for Microsoft Outlook 2013 (KB2880470) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{1BCA67A6-5329-48D0-A088-C097AC7A14BD}) (Version:  - Microsoft)
Update for Microsoft Visio 2013 (KB2878322) 32-Bit Edition (HKLM-x32\...\{90150000-0054-0407-0000-0000000FF1CE}_Office15.VISPROR_{99298FA5-31E3-4F40-A6AF-021459F6F37D}) (Version:  - Microsoft)
Update for Microsoft Visio 2013 (KB2878322) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{99298FA5-31E3-4F40-A6AF-021459F6F37D}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 32-Bit Edition (HKLM-x32\...\{90150000-006E-0407-0000-0000000FF1CE}_Office15.VISPROR_{25C61889-2E44-4BE1-9E96-9364BFDCF501}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{25C61889-2E44-4BE1-9E96-9364BFDCF501}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

==================== Custom CLSID entries: ==========================

(Only entries are listed that could be exploited by malware. If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\SlimDrivers Startup.job => ?

==================== Loaded Modules (whitelisted) =============

2013-09-16 23:32 - 2010-12-17 10:25 - 00686704 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2013-09-16 21:02 - 2000-01-01 02:00 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-29 02:23 - 2013-08-29 02:23 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\me\Downloads\Spam-email.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Cisco AnyConnect Secure Mobility Agent for Windows => "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
MSCONFIG\startupreg: CNAP2 Launcher => C:\Windows\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/24/2014 00:12:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10312

Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10312

Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9110

Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9110

Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8112

Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8112

Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (07/24/2014 00:10:10 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (07/23/2014 10:52:25 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (07/22/2014 04:23:56 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (07/21/2014 05:45:00 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (07/19/2014 04:57:13 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (07/18/2014 09:45:22 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (07/18/2014 10:19:59 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (07/17/2014 00:26:19 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (07/16/2014 05:38:38 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst G Data Personal Firewall konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (07/16/2014 08:13:20 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.


Microsoft Office Sessions:
=========================
Error: (07/24/2014 00:12:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10312

Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10312

Error: (07/24/2014 03:04:10 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9110

Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9110

Error: (07/24/2014 03:04:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8112

Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8112

Error: (07/24/2014 03:04:08 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


==================== Memory info ===========================

Percentage of memory in use: 30%
Total physical RAM: 8086.17 MB
Available physical RAM: 5608.69 MB
Total Pagefile: 16170.52 MB
Available Pagefile: 13371.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:107.69 GB) (Free:7.3 GB) NTFS
Drive d: () (Fixed) (Total:488.28 GB) (Free:197.54 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================

Danielll 24.07.2014 12:21
und noch die gmer.txt

Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-24 12:56:54
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK6461GSY rev.MC001D 596,17GB
Running: kij71fkq.exe; Driver: C:\Users\egal\AppData\Local\Temp\pxldypoc.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                00000000778fa400 7 bytes JMP 000000016fff0260
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                              0000000077903f20 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                000000007791ffb0 5 bytes JMP 000000016fff01f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                          000000007792f2e0 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                        0000000077959a30 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                        00000000779694c0 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                        0000000077969630 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                00000000779887e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                  000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                  000007feff147490 11 bytes JMP 000007fffda60228
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                000007feff15bf00 7 bytes JMP 000007fffda60260
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                            000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1352] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                          000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                      00000000778fa400 7 bytes JMP 000000016fff0260
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                    0000000077903f20 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                      000000007791ffb0 5 bytes JMP 000000016fff01f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                000000007792f2e0 5 bytes JMP 000000016fff0148
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                              0000000077959a30 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                              00000000779694c0 5 bytes JMP 000000016fff0180
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                              0000000077969630 5 bytes JMP 000000016fff0110
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                      00000000779887e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                        000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                  000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                    000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                  000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\ole32.dll!CoCreateInstance                                                        000007feff147490 11 bytes JMP 000007fffda60228
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1444] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                      000007feff15bf00 7 bytes JMP 000007fffda60260
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                    000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                  000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                              000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                              000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                            000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                                    000007fef7eadc88 5 bytes JMP 000007fff7ca00d8
.text  C:\Windows\system32\Dwm.exe[1648] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                                    000007fef7eade10 5 bytes JMP 000007fff7ca0110
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                00000000778fa400 7 bytes JMP 000000016fff0260
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                              0000000077903f20 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                              000000007791ffb0 5 bytes JMP 000000016fff01f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                        000000007792f2e0 5 bytes JMP 000000016fff0148
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                      0000000077959a30 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                      00000000779694c0 5 bytes JMP 000000016fff0180
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                      0000000077969630 5 bytes JMP 000000016fff0110
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                00000000779887e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                            000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                              000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                          000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                          000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                        000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\d3d9.dll!Direct3DCreate9Ex                                                000007fef85e2460 5 bytes JMP 000007fefda602d0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2732] C:\Windows\system32\d3d9.dll!Direct3DCreate9                                                  000007fef86196b0 6 bytes JMP 000007fefda60298
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                              000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                          000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                            000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                        000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                        000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[3744] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                      000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                        0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                          0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                          0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                          000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                  000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                  00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                  00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                    00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                                00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                      0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                    0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                        0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                            0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                            0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                        0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                        000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                    000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                      000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                          00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text  C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[3968] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                            0000000076219d0b 5 bytes JMP 00000001708f1217
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                              00000000778fa400 7 bytes JMP 000000016fff0260
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                            0000000077903f20 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                              000000007791ffb0 5 bytes JMP 000000016fff01f0
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                        000000007792f2e0 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                      0000000077959a30 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                      00000000779694c0 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                      0000000077969630 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                              00000000779887e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                          000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                            000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                        000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                          000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                        000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                000007feff147490 11 bytes JMP 000007fffda60228
.text  C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[3736] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                              000007feff15bf00 7 bytes JMP 000007fffda60260
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                00000000778fa400 7 bytes JMP 000000016fff0260
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                              0000000077903f20 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                000000007791ffb0 5 bytes JMP 000000016fff01f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                          000000007792f2e0 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                        0000000077959a30 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                        00000000779694c0 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                        0000000077969630 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                00000000779887e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                  000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                  000007feff147490 11 bytes JMP 000007fffda60228
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                000007feff15bf00 7 bytes JMP 000007fffda60260
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                            000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3824] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                          000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                  0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                  0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                  000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                          000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                          00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                          00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                            00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                        00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                              0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                            0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                    0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                    0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                        00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                            000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                              000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                  00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[3800] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                    0000000076219d0b 5 bytes JMP 00000001708f1217
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                      0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                        0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                        0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                      000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                              000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                              00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                              00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                            00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                    0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                  0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                      0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                        0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                  000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                        0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                    0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                    000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                              00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                        00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3676] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                        0000000076219d0b 5 bytes JMP 00000001708f1217
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                          000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                            000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                        000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                          000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                        000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                000007feff147490 11 bytes JMP 000007fffda60228
.text  C:\Windows\System32\igfxpers.exe[3896] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                              000007feff15bf00 7 bytes JMP 000007fffda60260
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                  0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                    0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                    0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                    000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                            000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                            00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                            00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                              00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                          00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                              0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                  0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                      0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                      0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                  0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                  000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                          00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                              000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                    00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                      0000000076219d0b 5 bytes JMP 00000001708f1217
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                            00000000756f1465 2 bytes [6F, 75]
.text  C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            00000000756f14bb 2 bytes [6F, 75]
.text  ...                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                      0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                        0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                        0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                        000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                  00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                                              00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                    0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                  0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                      0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                          0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                  000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                    000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                          0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                      0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                      000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[4548] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                              00000000763a7a5c 5 bytes JMP 00000001708f15c8
?      C:\Windows\system32\mssprxy.dll [4548] entry point in ".rdata" section                                                                                              00000000729671e6
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                            0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                              0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                              0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                              000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                      000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                      00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                      00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                        00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                                    00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                          0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                        0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                            0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                        000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                          000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                            0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                            000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                    00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                              00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4584] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                0000000076219d0b 5 bytes JMP 00000001708f1217
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW          0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegSetValueExW            0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegSetValueExA            0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW            000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW    000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx    00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation    00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW      00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2  00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW        0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW      0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW          0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary              0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList      000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo        000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!CreateWindowExW              0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA          0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW          000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo  00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket            00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text  C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4608] C:\Windows\syswow64\ole32.dll!CoCreateInstance              0000000076219d0b 5 bytes JMP 00000001708f1217
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                        00000000778fa400 7 bytes JMP 000000016fff0260
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                      0000000077903f20 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                        000000007791ffb0 5 bytes JMP 000000016fff01f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                  000000007792f2e0 5 bytes JMP 000000016fff0148
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                0000000077959a30 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                00000000779694c0 5 bytes JMP 000000016fff0180
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                0000000077969630 5 bytes JMP 000000016fff0110
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                        00000000779887e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                          000007fefda72db0 5 bytes JMP 000007fffda60180
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                    000007fefda737d0 7 bytes JMP 000007fffda600d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                      000007fefda78ef0 6 bytes JMP 000007fffda60148
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                  000007fefda8af60 5 bytes JMP 000007fffda60110
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                    000007feff3389e0 8 bytes JMP 000007fffda601f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4684] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                  000007feff33be40 8 bytes JMP 000007fffda601b8
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                          0000000075741f0e 7 bytes JMP 00000001708f168b
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                            0000000075745bad 7 bytes JMP 00000001708f11a4
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                            0000000075751409 7 bytes JMP 00000001708f1280
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                            000000007575ea45 7 bytes JMP 00000001708f123a
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                    000000007576b21b 5 bytes JMP 00000001708f15a0
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                    00000000757e8e24 7 bytes JMP 00000001708f132f
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                    00000000757e8ea9 5 bytes JMP 00000001708f16cc
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                      00000000757e91ff 1 byte JMP 00000001708f1703
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                                                                  00000000757e9201 3 bytes {JMP 0xfffffffffb108504}
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                        0000000075871d29 5 bytes JMP 00000001708f11bd
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                      0000000075871dd7 5 bytes JMP 00000001708f1014
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                          0000000075872ab1 5 bytes JMP 00000001708f154b
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                              0000000075872d17 5 bytes JMP 00000001708f1267
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                      000000007608e96b 5 bytes JMP 00000001708f15b9
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                        000000007608eba5 5 bytes JMP 00000001708f1181
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                              0000000076348a29 5 bytes JMP 00000001708f171c
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                          0000000076354572 5 bytes JMP 00000001708f10a0
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                          000000007636e567 5 bytes JMP 00000001708f140b
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                  00000000763a7a5c 5 bytes JMP 00000001708f15c8
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                            00000000761e5ea5 5 bytes JMP 00000001708f15f0
.text  C:\Users\me\Downloads\kij71fkq.exe[6100] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                              0000000076219d0b 5 bytes JMP 00000001708f1217

---- EOF - GMER 2.1 ----

schrauber 28.07.2014 18:37
Hi,

FRST bitte nochmal. Unsere Tools brauchen immer Adminrechte.

Danielll 28.07.2014 19:56
Oh sry das hatte ich übersehen. Hier die FRST.txt. Die Addition.txt hänge wegen der Grösse als archiv an.


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by egal (administrator) on ME-PC on 28-07-2014 20:46:13
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1003\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1004\...\MountPoints2: {255b9757-1f6a-11e3-a132-14feb5c55e8f} - F:\setup.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=U218DHP&pc=U218
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=
SearchScopes: HKLM-x32 - DefaultScope {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {473F7730-783B-4B9A-9619-3D4A35CFF663} URL = hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-28 20:46 - 2014-07-28 20:46 - 00016042 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-24 12:50 - 2014-07-24 12:57 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:34 - 2014-07-28 20:46 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-28 20:46 - 2014-07-28 20:46 - 00016042 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-28 20:46 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-28 20:15 - 2013-09-16 17:20 - 01655736 _____ () C:\Windows\WindowsUpdate.log
2014-07-28 20:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-27 22:56 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-27 22:56 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-27 22:49 - 2014-01-23 14:02 - 00003800 _____ () C:\Windows\setupact.log
2014-07-27 22:49 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-27 22:49 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-27 22:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 19:08 - 2014-05-26 16:08 - 00062946 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-25 08:55 - 2014-01-21 23:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 12:57 - 2014-07-24 12:50 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:55 - 2014-06-18 06:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:52 - 2013-10-09 14:08 - 00068776 _____ () C:\Users\egal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:05 - 2013-09-17 15:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:39 - 2013-09-16 20:56 - 00002828 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-06-30 04:09 - 2014-07-09 13:16 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-09 13:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

Some content of TEMP:
====================
C:\Users\egal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-28 14:22

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 29.07.2014 10:45
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307




Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

Danielll 30.07.2014 09:56
Die Datei Addition.txt ist zu gross um sie im einem Thread zu posten. Falls es noch eine andere Möglichkeit als über Anhang gibt, klär mich bitte auf. Den Rest führe ich nun durch und poste die logs

so hier die logs:

mbam.txt
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 30.07.2014
Scan Time: 09:54:29
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.30.03
Rootkit Database: v2014.07.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: egal

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 362274
Time Elapsed: 9 min, 27 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.Conduit.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\FF, Quarantined, [3a711293cab1b086edc3858d6e96758b],

Registry Values: 4
PUP.Optional.SearchCertified.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Bar, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Quarantined, [2b80485d66151c1a2a6892448181b34d]
PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s, Quarantined, [515a6e3789f2b77f81eda72e2ed4d52b]
PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|(Default), hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s, Quarantined, [2d7e8322fa81bd79de91dcf9f80a0cf4]
PUP.Optional.SearchCertified.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Bar, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Quarantined, [cfdcf4b1027974c2cfc1f0e632d0eb15]

Registry Data: 8
PUP.Optional.SimplyTech.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|newtab, %appdata%\SimplyTech\home\home.htm, Good: (www.google.com), Bad: (%appdata%\SimplyTech\home\home.htm),Replaced,[8c1f1b8ae29954e205507b33f70d6d93]
Hijack.SearchPage, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[76354362daa170c61ca207b017ed24dc]
Hijack.SearchPage, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com/), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[89224d586a11ed49fec2ebcca85cea16]
PUP.Optional.CertifiedToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Page, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[03a88c194f2ccd695d130ba3659fda26]
Hijack.SearchPage, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[4e5d6540691201354676f7c033d1669a]
Hijack.SearchPage, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (hxxp://www.google.com/), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[3378bbea3d3e37ffeed3f9be9e66b54b]
PUP.Optional.CertifiedToolBar.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Search Page, hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=, Good: (www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=),Replaced,[a803dfc60576b185ed7f0f9fef156b95]
PUP.Optional.SearchCertifiedTB.A, HKU\S-1-5-21-2200207277-3048083133-3753523746-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI|(Default), hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s, Good: (www.google.com), Bad: (hxxp://search.certified-toolbar.com?si=&st=bs&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=%s),Replaced,[eac11c892a51989e01d14475b153db25]

Folders: 0
(No malicious items detected)

Files: 6
PUP.Optional.InstallBrain.A, C:\Users\me\Downloads\cbsidlm-tr1_15-RollerCoaster_Tycoon_2_28_patch-ORG-10236743.exe, Quarantined, [d6d53a6b3348eb4b100432453aca13ed],
PUP.Optional.Babylon.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\babylon1.xml, Quarantined, [4b60cdd8b5c6e3536484eff4a35fc040],
PUP.Optional.Conduit.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\conduit.xml, Quarantined, [2f7c7e277ffc83b382d90ede7290728e],
PUP.Optional.WebConnect.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\extensions\firefox@webconnect.co.xpi, Quarantined, [a506dec7532851e552e35a93a45edc24],
PUP.Optional.WebSearch.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\searchplugins\Web Search.xml, Quarantined, [1d8e970eb9c2280eb18a1bd2798933cd],
PUP.Optional.CertifiedTB.A, C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "hxxp://search.certified-toolbar.com?si=&st=chrome&tid=6787&ver=4.4&ts=1379368800000.000007&tguid=66920-6787-1379400173721-F700B441CEAFA26E86F9F816B7CB32C0&q=");), Replaced,[8922069f45360b2ba4e15d8ce51f56aa]

Physical Sectors: 0
(No malicious items detected)


(end)
adwcleaner
Code:
# AdwCleaner v3.301 - Bericht erstellt am 30/07/2014 um 10:16:53
# Aktualisiert 28/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : egal - ME-PC
# Gestartet von : C:\Users\me\Downloads\adwcleaner_3.301.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Conduit
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Users\egal\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\me\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\me\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\me\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\me\AppData\LocalLow\SimplyTech
Ordner Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\Extensions\firejump@firejump.net
Datei Gelöscht : \END
Datei Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\.autoreg
Datei Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\user.js

***** [ Tasks ] *****

Task Gelöscht : FreeDriverScout
Task Gelöscht : Software Updater Ui
Task Gelöscht : Software Updater

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Mozilla Firefox v31.0 (x86 de)

[ Datei : C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default\prefs.js ]


[ Datei : C:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\2kohgpdn.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultengine", "Web Search");
Zeile gelöscht : user_pref("browser.search.order.1", "Web Search");

*************************

AdwCleaner[R0].txt - [2843 octets] - [30/07/2014 10:14:27]
AdwCleaner[S0].txt - [2666 octets] - [30/07/2014 10:16:53]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [2726 octets] ##########
jrt.txt
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by egal on 30.07.2014 at 10:25:25,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{473F7730-783B-4B9A-9619-3D4A35CFF663}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Emptied folder: C:\Users\egal\AppData\Roaming\mozilla\firefox\profiles\fjkx3l8o.default\minidumps [2 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.07.2014 at 10:33:44,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und die frst.txt


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by egal (administrator) on ME-PC on 30-07-2014 10:45:06
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-05-12] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1003\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1004\...\MountPoints2: {255b9757-1f6a-11e3-a132-14feb5c55e8f} - F:\setup.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=U218DHP&pc=U218
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11DEDE/WOL_WCP
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-30 10:45 - 2014-07-30 10:45 - 00015692 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-30 10:44 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:14 - 2014-07-30 10:17 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 09:50 - 2014-07-30 09:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-30 09:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-30 09:49 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-30 09:48 - 2014-07-30 09:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:55 - 2014-07-30 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-28 20:55 - 2014-07-28 20:55 - 00011077 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-24 12:50 - 2014-07-24 12:57 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:34 - 2014-07-30 10:45 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-30 10:45 - 2014-07-30 10:45 - 00015692 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-30 10:45 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-30 10:44 - 2013-09-16 17:20 - 01717468 _____ () C:\Windows\WindowsUpdate.log
2014-07-30 10:42 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-30 10:41 - 2014-01-23 14:02 - 00004304 _____ () C:\Windows\setupact.log
2014-07-30 10:41 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-30 10:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-30 10:35 - 2014-07-30 10:44 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:26 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:26 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:18 - 2014-06-25 01:15 - 00002406 _____ () C:\Windows\PFRO.log
2014-07-30 10:18 - 2013-09-16 20:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-30 10:17 - 2014-07-30 10:14 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 10:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-07-30 10:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-30 09:52 - 2014-07-30 09:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:56 - 2014-07-30 08:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-28 20:55 - 2014-07-28 20:55 - 00011077 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 19:08 - 2014-05-26 16:08 - 00062946 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-25 08:55 - 2014-01-21 23:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 12:57 - 2014-07-24 12:50 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:52 - 2013-10-09 14:08 - 00068776 _____ () C:\Users\egal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:05 - 2013-09-17 15:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:39 - 2013-09-16 20:56 - 00002828 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-06-30 04:09 - 2014-07-09 13:16 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-30 04:04 - 2014-07-09 13:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

Some content of TEMP:
====================
C:\Users\egal\AppData\Local\Temp\Quarantine.exe
C:\Users\egal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-28 14:22

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---
Die addition.txt ist wieder zu gross. Ich füge sie dewegen dem anhang bei. Falls es noch eine bessere Methode gibt, klär mich bitte auf.

danke für deine Hilfe. Gruss Daniel

schrauber 30.07.2014 15:19

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Danielll 30.07.2014 23:38
Hier die logs.
Eset online:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=092b7fb13096a34f81b53315b4e15d27
# engine=19421
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-30 10:21:49
# local_time=2014-07-31 12:21:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 49826 158388759 0 0
# scanned=221584
# found=13
# cleaned=0
# scan_time=21697
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\egal\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\egal\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=DEB9F64ABBF9425B70217747FEED6D2CF8BD9B6D ft=1 fh=a8b5d0d60197659c vn="Variante von MSIL/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\me\Downloads\DLG_free-driver-scout_chip_de-DE.exe"
sh=880E2A6F06E1174278C105DDFE86449E5BBA22E1 ft=1 fh=8276b7a7d9f0fc36 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe"
sh=7F559E33377FEC1DD2D3BF5F1618FA2F44F9E30D ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="D:\Firefox 23.0.1 (de) - 2013-09-14.pcv"
sh=DEB9F64ABBF9425B70217747FEED6D2CF8BD9B6D ft=1 fh=a8b5d0d60197659c vn="Variante von MSIL/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="D:\backup\programme\DLG_free-driver-scout_chip_de-DE.exe"
sh=913E612DFDC1621C87B1951BF2DC249162A3E12C ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\9e3bhg1j.default\extensions\firefox@webconnect.co.xpi"
sh=600A0295369F89C300038D770E5E114F2E25A3AF ft=1 fh=df0838ff15738a3a vn="Win32/DownloadAdmin.G evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\cbsidlm-tr1_9-Realtek_Drivers_Update_Utility-ORG2-75206690.exe"
sh=C50892AFB140D0DF96FA97EAF5E9DBE38F4D6763 ft=1 fh=2d5f71b798c9b785 vn="MSIL/Solimba evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\jDownloader.exe"
sh=04BFBB304B5F01B2F15C9A78692D502673209625 ft=1 fh=2ada4f9e12d44172 vn="möglicherweise Variante von Win32/YourFileDownloader.A evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\Patrick_Rothfuss_-_Die_Königsmörder-Chronik_Teil_1_-_Die_Furcht_des_Weisen_downloader_de_99251.exe"
sh=162E48A200E7BE135C61E792EF253530E034CFED ft=1 fh=36a8d984c1e7f819 vn="Win32/DriverBoss.B evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\realtek-drivers-update-utility.exe"
sh=49ACAFACAAC62A745E69D71A58CC9453C41B15D0 ft=1 fh=b98f31ba52914450 vn="Variante von Win32/Toolbar.Conduit.I evtl. unerwünschte Anwendung" ac=I fn="D:\Users\me\Downloads\UBCD4WinV360.exe"
security checkup:
Code:
Results of screen317's Security Check version 0.99.85 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
G Data InternetSecurity 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 40 
 Java version out of Date!
 Adobe Flash Player 14.0.0.145 
 Adobe Reader XI 
 Mozilla Firefox (31.0)
````````Process Check: objlist.exe by Laurent```````` 
 G Data InternetSecurity Firewall GDFwSvcx64.exe
 G Data InternetSecurity Firewall GDFirewallTray.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
und frst:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2014
Ran by egal (administrator) on ME-PC on 31-07-2014 00:35:43
Running from C:\Users\me\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corp.) C:\Windows\System32\Defrag.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1253520 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM\...\RunOnce: [BrandClearStubs] => RUNDLL32 IEDKCS32.DLL,BrandCleanInstallStubs >{F0DC35EF-6A04-4B5A-AC80-7653D02E21E9}
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-05-12] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1003\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2200207277-3048083133-3753523746-1004\...\MountPoints2: {255b9757-1f6a-11e3-a132-14feb5c55e8f} - F:\setup.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-12-18] (NVIDIA Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?ocid=U218DHP&pc=U218
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11DEDE/WOL_WCP
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:tabs
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\egal\AppData\Roaming\Mozilla\Firefox\Profiles\fjkx3l8o.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-05-27] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3203392 2014-05-20] (G Data Software AG)
R2 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2000-01-01] (Realtek Semiconductor)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-19] (DT Soft Ltd)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-09] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-09] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-07-09] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-09] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-07-09] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-23] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-09] (G Data Software AG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2013-05-09] (Intel Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-12-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-07-08] ()
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-31 00:35 - 2014-07-31 00:36 - 00016070 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-31 00:31 - 2014-07-31 00:31 - 00000836 _____ () C:\Users\egal\Downloads\checkup.txt
2014-07-31 00:25 - 2014-07-31 00:26 - 00854390 _____ () C:\Users\me\Downloads\SecurityCheck.exe
2014-07-30 18:10 - 2014-07-30 18:10 - 02347384 _____ (ESET) C:\Users\me\Downloads\esetsmartinstaller_deu.exe
2014-07-30 10:44 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:14 - 2014-07-30 10:17 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 09:50 - 2014-07-30 09:52 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-30 09:49 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-30 09:49 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-30 09:48 - 2014-07-30 09:49 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:55 - 2014-07-30 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-28 20:55 - 2014-07-30 11:00 - 00010076 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-24 12:50 - 2014-07-24 12:57 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:34 - 2014-07-31 00:35 - 00000000 ____D () C:\FRST
2014-07-24 12:30 - 2014-07-24 12:31 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:21 - 2014-07-24 11:22 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:55 - 2014-07-24 09:57 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-09 13:16 - 2014-06-30 04:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-09 13:16 - 2014-06-30 04:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-09 13:16 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 13:16 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-09 13:16 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 13:16 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 13:16 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 13:16 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 13:16 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 13:16 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 13:16 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-09 13:16 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 13:16 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-09 13:16 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 13:16 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 13:16 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 13:16 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-09 13:16 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-09 13:16 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-09 13:16 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-09 13:16 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-09 13:16 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-09 13:16 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-09 13:16 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-09 13:16 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-09 13:16 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-09 13:16 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-09 13:16 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-09 13:16 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-09 13:16 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-09 13:16 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-09 13:16 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-09 13:16 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-09 13:16 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-09 13:16 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 13:16 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-09 13:16 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-09 13:16 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-09 13:16 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 13:16 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-09 13:16 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 13:16 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 13:16 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-09 13:16 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-09 13:16 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-09 13:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 13:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-09 13:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-31 00:36 - 2014-07-31 00:35 - 00016070 _____ () C:\Users\me\Downloads\FRST.txt
2014-07-31 00:35 - 2014-07-24 12:34 - 00000000 ____D () C:\FRST
2014-07-31 00:31 - 2014-07-31 00:31 - 00000836 _____ () C:\Users\egal\Downloads\checkup.txt
2014-07-31 00:26 - 2014-07-31 00:25 - 00854390 _____ () C:\Users\me\Downloads\SecurityCheck.exe
2014-07-31 00:05 - 2013-09-17 15:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-30 23:05 - 2013-09-16 17:20 - 01719020 _____ () C:\Windows\WindowsUpdate.log
2014-07-30 18:10 - 2014-07-30 18:10 - 02347384 _____ (ESET) C:\Users\me\Downloads\esetsmartinstaller_deu.exe
2014-07-30 11:00 - 2014-07-28 20:55 - 00010076 _____ () C:\Users\me\Downloads\Addition.zip
2014-07-30 10:49 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:49 - 2009-07-14 06:45 - 00022528 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-30 10:42 - 2013-09-16 20:56 - 00000404 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2014-07-30 10:41 - 2014-01-23 14:02 - 00004304 _____ () C:\Windows\setupact.log
2014-07-30 10:41 - 2013-09-16 22:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-30 10:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-30 10:35 - 2014-07-30 10:44 - 00000972 _____ () C:\Users\me\Downloads\JRT.txt
2014-07-30 10:35 - 2014-07-30 10:35 - 00000972 _____ () C:\Users\egal\Downloads\JRT.txt
2014-07-30 10:33 - 2014-07-30 10:33 - 00000972 _____ () C:\Users\egal\Desktop\JRT.txt
2014-07-30 10:28 - 2014-07-30 10:28 - 00001425 _____ () C:\Users\egal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-30 10:25 - 2014-07-30 10:25 - 00000000 ____D () C:\Windows\ERUNT
2014-07-30 10:23 - 2014-07-30 10:23 - 01016261 _____ (Thisisu) C:\Users\me\Downloads\JRT.exe
2014-07-30 10:18 - 2014-06-25 01:15 - 00002406 _____ () C:\Windows\PFRO.log
2014-07-30 10:18 - 2013-09-16 20:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-30 10:17 - 2014-07-30 10:14 - 00000000 ____D () C:\AdwCleaner
2014-07-30 10:13 - 2014-07-30 10:13 - 01365525 _____ () C:\Users\me\Downloads\adwcleaner_3.301.exe
2014-07-30 10:12 - 2014-07-30 10:12 - 00007694 _____ () C:\Users\me\Downloads\mbam.txt
2014-07-30 10:07 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-07-30 09:52 - 2014-07-30 09:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 09:49 - 2014-07-30 09:49 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-30 09:49 - 2014-07-30 09:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\me\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-30 08:56 - 2014-07-30 08:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-27 13:21 - 2014-01-21 23:33 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 19:08 - 2014-05-26 16:08 - 00062946 _____ () C:\Users\me\Desktop\Neues Textdokument.txt
2014-07-25 08:55 - 2014-01-21 23:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-24 12:57 - 2014-07-24 12:50 - 00062923 _____ () C:\Users\me\Downloads\gmer.txt
2014-07-24 12:31 - 2014-07-24 12:30 - 00000470 _____ () C:\Users\me\Downloads\defogger_disable.log
2014-07-24 12:30 - 2014-07-24 12:30 - 00000000 _____ () C:\Users\egal\defogger_reenable
2014-07-24 12:30 - 2013-09-21 20:25 - 00000000 ____D () C:\Users\egal
2014-07-24 12:07 - 2014-07-24 12:07 - 00012940 _____ () C:\Users\me\Desktop\G Data Protokoll ID 3226.txt
2014-07-24 11:55 - 2013-09-19 20:48 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-07-24 11:23 - 2014-07-24 11:23 - 02093568 _____ (Farbar) C:\Users\me\Downloads\FRST64.exe
2014-07-24 11:22 - 2014-07-24 11:22 - 00050477 _____ () C:\Users\me\Downloads\Defogger.exe
2014-07-24 11:22 - 2014-07-24 11:21 - 00380416 _____ () C:\Users\me\Downloads\kij71fkq.exe
2014-07-24 09:57 - 2014-07-24 09:55 - 00002744 _____ () C:\Users\me\Downloads\Spam-email.eml
2014-07-24 09:52 - 2013-10-09 14:08 - 00068776 _____ () C:\Users\egal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-24 09:47 - 2014-07-24 09:47 - 00826192 _____ (Chip Digital GmbH) C:\Users\me\Downloads\Sysinternals Suite - CHIP-Installer.exe
2014-07-24 09:39 - 2013-09-17 16:28 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-07-16 08:02 - 2014-07-16 08:02 - 00000000 ____D () C:\ProgramData\Riot Games
2014-07-14 03:00 - 2013-09-19 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-10 13:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-10 03:24 - 2009-07-14 06:45 - 00343896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-10 03:22 - 2014-05-07 06:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-10 03:22 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-10 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-10 03:05 - 2013-09-16 22:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-10 03:03 - 2013-09-16 22:09 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 15:05 - 2013-09-17 15:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 15:05 - 2013-09-17 15:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-09 00:30 - 2014-07-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
2014-07-09 00:30 - 2014-05-23 09:24 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2014-07-09 00:30 - 2014-05-23 09:24 - 00001978 _____ () C:\Users\Public\Desktop\G Data InternetSecurity.lnk
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-07-09 00:30 - 2013-09-16 20:23 - 00061440 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-07-09 00:29 - 2014-05-23 09:23 - 00004114 _____ () C:\Windows\DPINST.LOG
2014-07-09 00:29 - 2013-09-16 20:23 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-07-09 00:29 - 2013-09-16 20:23 - 00055808 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\ProgramData\Astroburn Lite
2014-07-08 15:13 - 2014-07-08 15:13 - 00000000 ____D () C:\Program Files (x86)\Astroburn Lite
2014-07-08 15:11 - 2013-10-12 00:17 - 00000000 ____D () C:\Users\egal\AppData\Roaming\DAEMON Tools Lite
2014-07-08 14:47 - 2014-07-08 14:47 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2014-07-08 14:39 - 2013-10-09 14:06 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-07-08 14:39 - 2013-09-16 20:56 - 00002828 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2014-07-08 14:09 - 2014-07-08 14:09 - 00000000 ____D () C:\Users\egal\AppData\Roaming\LolClient
2014-07-08 14:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-08 10:43 - 2014-07-08 10:43 - 00002562 _____ () C:\Windows\diagwrn.xml
2014-07-08 10:43 - 2014-07-08 10:43 - 00001908 _____ () C:\Windows\diagerr.xml
2014-07-08 10:43 - 2014-01-23 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-06 09:04 - 2013-09-16 22:48 - 00068776 _____ () C:\Users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-05 21:10 - 2014-07-05 21:10 - 13854448 _____ () C:\Users\me\Downloads\thriXXX Launcher.exe
2014-07-01 05:00 - 2014-07-01 05:00 - 00000000 ____D () C:\Program Files (x86)\Dell Digital Delivery
2014-07-01 05:00 - 2013-09-17 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell

Some content of TEMP:
====================
C:\Users\egal\AppData\Local\Temp\Quarantine.exe
C:\Users\egal\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\me\AppData\Local\Temp\RSPUpgradeInstaller.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-28 14:22

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---
und die additon ist wieder im Anhang.
Gruss Daniel

schrauber 31.07.2014 20:02
Java updaten.

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen




Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:18 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55