Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 22.12.2014, 21:06   #1
kaethe_
 
Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



Liebes Trojaner-Board,

dieses Mal melde ich mich bei euch, weil scheinbar der PC meiner Mutter mit dem Programm Super easy driver und eventuell noch weiteren Programmen befallen ist. Meine Mutter hatte vor einem Monat mbam durchgeführt und dabei viele, viele Dinge gefunden. Sie meinte, sie haben plötzlich viel Werbung und ich habe sie angeraten, mbam und adwcleaner durchzuführen. Die Werbungen sind weg, mbam zeigt kein Ergebnis mehr. Aber adwcleaner.
Da ich nicht weiß, ob sich noch mehr in diesem PC versteckt, möchte ich euch bitten, ob ihr einmal nachsehen könntet, damit ihr PC wirklich sauber ist.
Aktuelle Auffälligkeiten: Das einzige was ihr aufgefallen ist, ist dieses Supereasy driver beim Start hochfährt. Sonst wäre wohl ncihts verändert.

Hier die Dateien:

mbam vor einem Monat habe ich aus Zeichenplatzgründen nicht anhängen können.

adwcleaner vor einem Monat

Code:
ATTFilter
# AdwCleaner v4.102 - Bericht erstellt am 26/11/2014 um 21:26:56
# Aktualisiert 23/11/2014 von Xplode
# Database : 2014-11-26.1 [Live]
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Ingrid - VAI
# Gestartet von : C:\Users\Ingrid\Downloads\AdwCleaner_4.102.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : APNMCP

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default\user.js
Datei Gefunden : C:\WINDOWS\System32\roboot64.exe
Ordner Gefunden : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gefunden : C:\Program Files (x86)\ASP
Ordner Gefunden : C:\Program Files (x86)\PC Speed Maximizer
Ordner Gefunden : C:\Program Files (x86)\Tweaks
Ordner Gefunden : C:\Program Files (x86)\WinZip Malware Protector
Ordner Gefunden : C:\ProgramData\apn
Ordner Gefunden : C:\ProgramData\AskPartnerNetwork
Ordner Gefunden : C:\ProgramData\iolo
Ordner Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced-System Protector
Ordner Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileOpener
Ordner Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Maximizer
Ordner Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
Ordner Gefunden : C:\ProgramData\Systweak
Ordner Gefunden : C:\Users\Ingrid\AppData\Local\AskPartnerNetwork
Ordner Gefunden : C:\Users\Ingrid\AppData\Local\Astromenda
Ordner Gefunden : C:\Users\Ingrid\AppData\Roaming\1H1Q
Ordner Gefunden : C:\Users\Ingrid\AppData\Roaming\iolo
Ordner Gefunden : C:\Users\Ingrid\AppData\Roaming\PC Speed Maximizer
Ordner Gefunden : C:\Users\Ingrid\AppData\Roaming\Systweak
Ordner Gefunden : C:\Users\Ingrid\Documents\PC Speed Maximizer

***** [ Tasks ] *****

Task Gefunden : advanced-System Protector_startup
Task Gefunden : PC Speed Maximizer Schedule
Task Gefunden : RegClean Pro

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AskPartnerNetwork
Schlüssel Gefunden : HKCU\Software\BRS
Schlüssel Gefunden : HKCU\Software\ClickConnect
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{41564952-412D-5637-00A7-7A786E7484D7}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41564952-412D-5637-00A7-7A786E7484D7}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\File Opener Packages
Schlüssel Gefunden : HKCU\Software\pc speed maximizer
Schlüssel Gefunden : HKCU\Software\systweak
Schlüssel Gefunden : [x64] HKCU\Software\AskPartnerNetwork
Schlüssel Gefunden : [x64] HKCU\Software\BRS
Schlüssel Gefunden : [x64] HKCU\Software\ClickConnect
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gefunden : [x64] HKCU\Software\pc speed maximizer
Schlüssel Gefunden : [x64] HKCU\Software\systweak
Schlüssel Gefunden : HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{44CBC005-6243-4502-8A02-3A096A282664}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D8278076-BC68-4484-9233-6E7F1628B56C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{F297534D-7B06-459D-BC19-2DD8EF69297B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9945959C-AAD8-4312-8B57-2DE11927E770}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EEA63863-87BC-4DCA-A5B5-EB97E3B04806}
Schlüssel Gefunden : HKLM\SOFTWARE\InstallCore
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Speed Maximizer_is1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tweaks FileOpener
Schlüssel Gefunden : HKLM\SOFTWARE\systweak
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\AskPartnerNetwork
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{41564952-412D-5637-00A7-7A786E7484D7}]
Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [PC Speed Maximizer]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{41564952-412D-5637-00A7-7A786E7484D7}]
Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{41564952-412D-5637-00A7-7A786E7484D7}]

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v33.1 (x86 de)

[gb8jmp8j.default] - Zeile gefunden : user_pref("extensions.astrmndasr.hmpgUrl", "hxxp://astromenda.com/?f=1&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytD[...]
[gb8jmp8j.default] - Zeile gefunden : user_pref("extensions.astrmndasr.newTabUrl", "hxxp://astromenda.com/?f=2&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzy[...]
[gb8jmp8j.default] - Zeile gefunden : user_pref("extensions.astrmndasr.prtnrId", "WSE_Astromenda");
[gb8jmp8j.default] - Zeile gefunden : user_pref("extensions.astrmndasr.srchPrvdr", "Astromenda");
[gb8jmp8j.default] - Zeile gefunden : user_pref("extensions.astrmndasr.tlbrSrchUrl", "hxxp://astromenda.com/?f=3&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtB[...]

-\\ Google Chrome v39.0.2171.65

[C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Web data] - Gefunden [Search Provider] : hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1351351
[C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Web data] - Gefunden [Search Provider] : hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1351351
[C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Web data] - Gefunden [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCtDyCtCtD0CtByEtG0C0Azy0FtGyC0B0F0AtG0DzyyDtDtGtCyC0D0F0EtB0AtByB0F0C0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0AtByCyE0EyBzztGzyzyzz0DtGyEyCtDtCtG0A0A0EyDtGtA0DyBtBtBzztAyDyB0F0C0C2Q&cr=1985374833&ir=

-\\ Opera v25.0.1614.71


########## EOF - C:\AdwCleaner\AdwCleaner[R4].txt - [8244 octets] ##########
         
mbam aktuell
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 22.12.2014
Suchlauf-Zeit: 19:19:58
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.22.07
Rootkit Datenbank: v2014.12.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Ingrid

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 399972
Verstrichene Zeit: 41 Min, 4 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

GMER
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-22 20:18:12
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000029 TOSHIBA_MQ01ABF050 rev.AM002H 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Ingrid\AppData\Local\Temp\pxldypow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\mfevtps.exe[2020] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506                          00007ffbe616169a 4 bytes [16, E6, FB, 7F]
.text   C:\Windows\system32\mfevtps.exe[2020] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514                          00007ffbe61616a2 4 bytes [16, E6, FB, 7F]
.text   C:\Windows\system32\mfevtps.exe[2020] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118                             00007ffbe616181a 4 bytes [16, E6, FB, 7F]
.text   C:\Windows\system32\mfevtps.exe[2020] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142                             00007ffbe6161832 4 bytes [16, E6, FB, 7F]
.text   C:\WINDOWS\Explorer.EXE[2988] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                  00007ffbe616169a 4 bytes [16, E6, FB, 7F]
.text   C:\WINDOWS\Explorer.EXE[2988] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                  00007ffbe61616a2 4 bytes [16, E6, FB, 7F]
.text   C:\WINDOWS\Explorer.EXE[2988] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                     00007ffbe616181a 4 bytes [16, E6, FB, 7F]
.text   C:\WINDOWS\Explorer.EXE[2988] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                     00007ffbe6161832 4 bytes [16, E6, FB, 7F]
.text   C:\Windows\System32\igfxpers.exe[5380] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                         00007ffbe616169a 4 bytes [16, E6, FB, 7F]
.text   C:\Windows\System32\igfxpers.exe[5380] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                         00007ffbe61616a2 4 bytes [16, E6, FB, 7F]
.text   C:\Windows\System32\igfxpers.exe[5380] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                            00007ffbe616181a 4 bytes [16, E6, FB, 7F]
.text   C:\Windows\System32\igfxpers.exe[5380] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                            00007ffbe6161832 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[5708] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506   00007ffbe616169a 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[5708] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514   00007ffbe61616a2 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[5708] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118      00007ffbe616181a 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[5708] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142      00007ffbe6161832 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[5708] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194         00007ffbcf811f6a 4 bytes [81, CF, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[5708] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218         00007ffbcf811f82 4 bytes [81, CF, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5956] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194  00007ffbcf811f6a 4 bytes [81, CF, FB, 7F]
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5956] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218  00007ffbcf811f82 4 bytes [81, CF, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe[3320] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506            00007ffbe616169a 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe[3320] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514            00007ffbe61616a2 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe[3320] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118               00007ffbe616181a 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe[3320] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142               00007ffbe6161832 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\VCPerfService.exe[6328] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506        00007ffbe616169a 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\VCPerfService.exe[6328] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514        00007ffbe61616a2 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\VCPerfService.exe[6328] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118           00007ffbe616181a 4 bytes [16, E6, FB, 7F]
.text   C:\Program Files\Sony\VAIO Care\VCPerfService.exe[6328] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142           00007ffbe6161832 4 bytes [16, E6, FB, 7F]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [740:788]                                                                               fffff9600084cb90
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [5648:2208]                                                        00007ffbe5d781b0
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [5648:5108]                                                        00007ffbe5770310
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [5648:5260]                                                        00007ffbe5770310

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                 unknown MBR code

---- EOF - GMER 2.1 ----
         

adwcleaner aktuell

Code:
ATTFilter
# AdwCleaner v4.106 - Bericht erstellt am 22/12/2014 um 19:12:33
# Aktualisiert 21/12/2014 von Xplode
# Database : 2014-12-21.4 [Live]
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Ingrid - VAI
# Gestartet von : C:\Users\Ingrid\Downloads\AdwCleaner_4.106.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SuperEasy Software
Ordner Gelöscht : C:\Program Files (x86)\SuperEasy Software
Ordner Gelöscht : C:\Users\Ingrid\AppData\Roaming\SuperEasy Software
Ordner Gelöscht : C:\Users\Ingrid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SuperEasy Software
Datei Gelöscht : C:\Users\Public\Desktop\WinZip Malware Protector.lnk
Datei Gelöscht : C:\WINDOWS\System32\wsusnative64.exe

***** [ Tasks ] *****

Task Gelöscht : SuperEasyDriverUpdater_UPDATES
Task Gelöscht : WinZip Malware Protector_startup

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\SuperEasy Software
Schlüssel Gelöscht : HKLM\SOFTWARE\SuperEasy Software
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Firefox Packages
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{039BC111-D60F-A6FF-85F4-7992EA886B8D}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinZip Malware Protector_is1

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v34.0.5 (x86 de)


-\\ Google Chrome v39.0.2171.95

[C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCtDyCtCtD0CtByEtG0C0Azy0FtGyC0B0F0AtG0DzyyDtDtGtCyC0D0F0EtB0AtByB0F0C0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0AtByCyE0EyBzztGzyzyzz0DtGyEyCtDtCtG0A0A0EyDtGtA0DyBtBtBzztAyDyB0F0C0C2Q&cr=1985374833&ir=

-\\ Opera v26.0.1656.60

[C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCtDyCtCtD0CtByEtG0C0Azy0FtGyC0B0F0AtG0DzyyDtDtGtCyC0D0F0EtB0AtByB0F0C0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0AtByCyE0EyBzztGzyzyzz0DtGyEyCtDtCtG0A0A0EyDtGtA0DyBtBtBzztAyDyB0F0C0C2Q&cr=1985374833&ir=

*************************


########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [3346 octets] ##########
         


FRST

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-12-2014 01
Ran by Ingrid (administrator) on VAI on 22-12-2014 20:06:51
Running from C:\Users\Ingrid\Downloads
Loaded Profiles: Ingrid &  (Available profiles: Ingrid)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\BCMWLTRY.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\SUSSoundProxy.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\Bluetooth Headset Helper.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-20] (Realtek Semiconductor)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe [10592256 2013-11-09] (Broadcom Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2752752 2013-07-12] (Synaptics Incorporated)
HKLM\...\Run: [Bluetooth] => C:\Program Files\WIDCOMM\Bluetooth Software\bttray.exe [534232 2013-09-04] (Broadcom Corporation.)
HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [740376 2013-02-06] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2013-02-19] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2353880 2013-11-01] (Microsoft Corp.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-07-24] (Panda Security, S.L.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\SYSTEM32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-09-15] (Glarysoft Ltd)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\...\RunOnce: [Adobe Speed Launcher] => 1419272151
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-09-15] (Glarysoft Ltd)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [Adobe Speed Launcher] => 1419272151
BootExecute: autocheck autochk *  

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://sony13.msn.com
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://vaioportal.sony.eu
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://vaioportal.sony.eu
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://sony13.msn.com
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://vaioportal.sony.eu
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://vaioportal.sony.eu
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2085259247-1724912421-3600129739-1001 -> {19977BDD-E6FC-4A2B-861C-4015A877DE15} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-&_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {19977BDD-E6FC-4A2B-861C-4015A877DE15} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-&_nkw={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\Sony\MSS\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 217.0.43.113 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.13.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files\Sony\MSS\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2085259247-1724912421-3600129739-1001: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll (Intel)
FF Plugin HKU\S-1-5-21-2085259247-1724912421-3600129739-1001: intel.com/AppUpx64 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)
FF Plugin HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll (Intel)
FF Plugin HKU\S-1-5-21-2085259247-1724912421-3600129739-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: intel.com/AppUpx64 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)
FF Extension: Deutsch (DE) Language Pack - C:\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-05-18]
FF Extension: Search-App - C:\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default\Extensions\{2ec58dc4-24a6-4bfa-8997-204f24f8a1f9}.xpi [2014-10-14]

Chrome: 
=======
CHR DefaultSearchKeyword: Default -> astromenda.com
CHR DefaultSearchURL: Default -> hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCtDyCtCtD0CtByEtG0C0Azy0FtGyC0B0F0AtG0DzyyDtDtGtCyC0D0F0EtB0AtByB0F0C0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0AtByCyE0EyBzztGzyzyzz0DtGyEyCtDtCtG0A0A0EyDtGtA0DyBtBtBzztAyDyB0F0C0C2Q&cr=1985374833&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-12]
CHR Extension: (Avira Browser Safety) - C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-12]
CHR Extension: (Google Wallet) - C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)
R2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-19] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129824 2013-01-23] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166688 2013-01-23] (Intel Corporation)
S3 McComponentHostServiceSony; C:\Program Files\Sony\MSS\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-09-24] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-09-24] (McAfee, Inc.)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [141560 2014-07-24] (Panda Security, S.L.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [629336 2013-09-28] (Sony Corporation)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [61688 2014-07-23] (Panda Security, S.L.)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-02-06] (Sony Corporation)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-07-24] (Panda Security, S.L.)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [266168 2013-11-19] (Intel Corporation)
S3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-19] (Intel Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [972000 2013-01-06] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe [6099968 2013-11-09] (Broadcom Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-12-01] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43064 2014-10-07] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8469680 2013-12-01] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 cfwids; C:\Windows\system32\drivers\cfwids.sys [70112 2013-09-24] (McAfee, Inc.)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2014-12-22] (Emsisoft GmbH)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 GUBootStartup; C:\WINDOWS\System32\drivers\GUBootStartup.sys [20672 2014-09-21] (Glarysoft Ltd)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-22] (Malwarebytes Corporation)
S3 mfeapfk; C:\Windows\system32\drivers\mfeapfk.sys [179664 2013-09-24] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-09-24] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69264 2013-09-24] (McAfee, Inc.)
R3 mfefirek; C:\Windows\system32\drivers\mfefirek.sys [519192 2013-09-24] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [781312 2013-09-24] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [95984 2013-09-20] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-09-24] (McAfee, Inc.)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [160800 2014-07-24] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [120352 2014-07-24] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [106016 2014-07-24] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 semav6thermal64ro; C:\WINDOWS\system32\drivers\semav6thermal64ro.sys [13792 2014-05-12] ()
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-07-12] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-22 20:06 - 2014-12-22 20:07 - 00024984 _____ () C:\Users\Ingrid\Downloads\FRST.txt
2014-12-22 20:06 - 2014-12-22 20:06 - 00000000 ____D () C:\FRST
2014-12-22 19:34 - 2014-12-22 19:34 - 00380416 _____ () C:\Users\Ingrid\Downloads\Gmer-19357.exe
2014-12-22 19:33 - 2014-12-22 19:34 - 00602112 _____ (OldTimer Tools) C:\Users\Ingrid\Downloads\OTL.exe
2014-12-22 19:32 - 2014-12-22 19:33 - 02122240 _____ (Farbar) C:\Users\Ingrid\Downloads\FRST64.exe
2014-12-22 19:12 - 2014-12-22 20:05 - 00000000 ____D () C:\Users\Ingrid\Desktop\Trojaner board
2014-12-22 19:06 - 2014-12-22 19:06 - 02173952 _____ () C:\Users\Ingrid\Downloads\AdwCleaner_4.106.exe
2014-12-22 18:18 - 2014-12-22 18:24 - 00000000 ____D () C:\EEK
2014-12-22 18:18 - 2014-12-22 18:18 - 00000755 _____ () C:\Users\Ingrid\Desktop\Start Emsisoft Emergency Kit.lnk
2014-12-22 17:46 - 2014-12-22 18:16 - 163414032 _____ () C:\Users\Ingrid\Downloads\EmsisoftEmergencyKit.exe
2014-12-22 14:49 - 2014-12-22 14:49 - 00167669 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141222(1).zip
2014-12-22 14:47 - 2014-12-22 14:48 - 00329820 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141222.zip
2014-12-20 12:08 - 2014-12-20 12:13 - 25079726 _____ () C:\Users\Ingrid\Documents\kragen.htm
2014-12-20 12:01 - 2014-12-20 12:05 - 25079726 _____ () C:\Users\Ingrid\Downloads\70148775.zip
2014-12-16 18:28 - 2014-12-16 18:28 - 00282518 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141216.zip
2014-12-15 14:19 - 2014-12-15 14:19 - 00283528 _____ () C:\WINDOWS\Minidump\121514-44531-01.dmp
2014-12-15 14:18 - 2014-12-15 14:18 - 412850640 _____ () C:\WINDOWS\MEMORY.DMP
2014-12-13 17:12 - 2014-11-26 22:10 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-12-13 17:12 - 2014-11-26 22:10 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-13 17:02 - 2014-12-13 17:02 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-13 16:03 - 2014-12-13 16:03 - 00000000 __SHD () C:\Users\Ingrid\AppData\Local\EmieBrowserModeList
2014-12-11 17:37 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-11 17:37 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-11 17:37 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-11 17:37 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-11 17:36 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-11 17:36 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-11 17:36 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-11 17:36 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-11 17:10 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-11 17:10 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-11 17:10 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-11 17:10 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2014-12-11 17:06 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-11 17:06 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-11 17:05 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 17:05 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-11 17:04 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-11 17:04 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-11 17:04 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-11 17:04 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-11 17:04 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-11 17:04 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-11 17:04 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-11 17:04 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-11 17:04 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-11 17:04 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-11 17:04 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-11 17:04 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-11 17:03 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-11 17:03 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-11 17:03 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-11 17:03 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-11 17:03 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-11 17:03 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-11 17:03 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-11 17:03 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-11 17:03 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-11 17:03 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-11 17:03 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-11 17:03 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-11 17:03 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-11 17:03 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-11 17:03 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-11 17:03 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-11 17:03 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-11 17:03 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-11 17:03 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-11 17:03 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-11 17:03 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-11 17:03 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-11 17:03 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-11 17:03 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-11 17:03 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-11 17:03 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-11 17:03 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 20:49 - 2014-12-10 20:51 - 09547145 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141210.zip
2014-12-09 19:22 - 2014-12-09 19:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-05 16:29 - 2014-12-05 16:30 - 01037134 _____ () C:\Users\Ingrid\Downloads\gsm20090660_pfefferkuchenmann.zip
2014-12-05 16:12 - 2014-12-05 16:12 - 00115918 _____ () C:\Users\Ingrid\Downloads\Geb_hrenfrei_MasterCard_Gold_-_Rechnung_03_12_2014.eml
2014-12-02 17:41 - 2014-12-02 17:41 - 00249955 _____ () C:\Users\Ingrid\Downloads\RechnungOnline_Monat_Dezember_2014_Buchungskonto_4736946773.eml
2014-12-02 15:16 - 2014-12-02 15:16 - 00262269 _____ () C:\Users\Ingrid\Documents\E-Mail.htm12.htm
2014-12-02 15:16 - 2014-12-02 15:16 - 00000000 ____D () C:\Users\Ingrid\Documents\E-Mail.htm12-Dateien
2014-12-01 18:35 - 2014-12-01 18:35 - 00219847 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141201.zip
2014-11-30 15:26 - 2014-11-30 15:26 - 00061338 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141130.zip
2014-11-30 13:09 - 2014-11-30 13:20 - 00279663 _____ () C:\Users\Ingrid\Downloads\pcSelectLayout.do.part
2014-11-29 19:54 - 2014-11-29 19:56 - 00000921 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141129.zip
2014-11-29 19:06 - 2014-11-29 19:06 - 00000722 _____ () C:\Users\Ingrid\Documents\Warenkorb.psc
2014-11-29 19:06 - 2014-11-29 19:06 - 00000000 ____D () C:\Users\Ingrid\Documents\Warenkorb-Dateien
2014-11-29 18:56 - 2014-12-02 17:44 - 00000000 ____D () C:\Users\Ingrid\Documents\Postkarte Set(12 Stk.) 148x105 mm-Dateien
2014-11-29 18:56 - 2014-11-29 18:56 - 00010363 _____ () C:\Users\Ingrid\Documents\Postkarte Set(12 Stk.) 148x105 mm.pcf
2014-11-28 17:06 - 2014-11-28 17:06 - 00161660 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141128.zip
2014-11-26 21:53 - 2014-11-26 21:53 - 01707532 _____ (Thisisu) C:\Users\Ingrid\Downloads\JRT(1).exe
2014-11-26 21:50 - 2014-11-26 21:50 - 02148864 _____ () C:\Users\Ingrid\Downloads\AdwCleaner_4.102(1).exe
2014-11-26 21:25 - 2014-11-26 21:25 - 02148864 _____ () C:\Users\Ingrid\Downloads\AdwCleaner_4.102.exe
2014-11-26 20:13 - 2014-11-26 20:16 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Ingrid\Downloads\mbam-setup-2.0.3.1025.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-22 20:08 - 2013-12-01 18:25 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-22 20:01 - 2013-09-28 14:34 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2085259247-1724912421-3600129739-1001
2014-12-22 20:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-12-22 19:54 - 2013-09-28 17:53 - 00000000 ____D () C:\Users\Ingrid\AppData\Roaming\Skype
2014-12-22 19:19 - 2014-04-10 09:25 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-22 19:18 - 2014-04-10 10:39 - 01274368 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-22 19:17 - 2014-04-10 10:51 - 00000000 ___DO () C:\Users\Ingrid\SkyDrive
2014-12-22 19:15 - 2013-12-01 18:25 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-22 19:14 - 2014-09-21 16:55 - 00000342 _____ () C:\WINDOWS\Tasks\GlaryInitialize 5.job
2014-12-22 19:14 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-22 19:13 - 2013-11-13 23:18 - 00324992 _____ () C:\WINDOWS\PFRO.log
2014-12-22 19:13 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-12-22 19:12 - 2014-08-05 19:11 - 00000000 ____D () C:\AdwCleaner
2014-12-22 19:09 - 2014-04-15 19:16 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-12-22 18:57 - 2014-10-02 15:32 - 00003196 _____ () C:\WINDOWS\System32\Tasks\SuperEasyDriverUpdaterRunAtStartup
2014-12-22 14:45 - 2014-05-19 16:56 - 00003914 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{11CC6469-67D9-4BA3-9306-FCB687CE1FAA}
2014-12-21 11:48 - 2014-03-15 18:58 - 00117760 ___SH () C:\Users\Ingrid\Documents\Thumbs.db
2014-12-21 11:11 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-12-21 11:04 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-20 17:05 - 2013-11-14 08:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-20 17:05 - 2013-11-14 08:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-20 17:05 - 2013-11-14 08:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-18 19:54 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-17 17:03 - 2014-10-05 13:12 - 00003842 _____ () C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1412511148
2014-12-17 17:03 - 2014-10-05 13:12 - 00001057 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-12-17 17:03 - 2014-10-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-16 16:06 - 2014-10-16 15:25 - 00001153 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-16 16:06 - 2013-09-28 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-16 16:06 - 2013-09-28 15:27 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-16 16:06 - 2013-05-25 06:41 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-15 14:19 - 2014-11-09 16:54 - 00000000 ____D () C:\WINDOWS\Minidump
2014-12-15 14:19 - 2014-04-10 10:16 - 00000000 ____D () C:\Users\Ingrid
2014-12-15 13:57 - 2013-08-22 15:46 - 00313638 _____ () C:\WINDOWS\setupact.log
2014-12-14 13:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-13 17:09 - 2014-04-10 11:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-13 17:02 - 2014-07-26 16:01 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-13 17:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-13 17:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-13 17:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-13 16:55 - 2013-12-31 15:31 - 00647168 ___SH () C:\Users\Ingrid\Desktop\Thumbs.db
2014-12-13 16:03 - 2014-06-30 16:05 - 00000000 ____D () C:\Users\Ingrid\AppData\Local\Adobe
2014-12-13 16:02 - 2014-04-15 19:16 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-13 13:18 - 2013-12-05 19:59 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-13 13:15 - 2013-10-17 16:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-13 13:08 - 2013-10-17 16:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-10 16:23 - 2013-05-25 07:22 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-08 14:22 - 2014-01-02 15:40 - 00000000 ____D () C:\Users\Ingrid\Desktop\Katharina_Bachelor
2014-12-06 13:12 - 2014-09-27 20:58 - 00000000 ____D () C:\Users\Ingrid\Desktop\Fotos Katharina
2014-12-06 12:00 - 2014-09-27 21:15 - 00000000 ____D () C:\Users\Ingrid\Documents\Outlook-Dateien
2014-12-06 11:14 - 2014-05-23 11:00 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-06 11:14 - 2014-04-10 09:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-06 11:14 - 2014-04-10 09:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-02 17:35 - 2014-07-08 16:07 - 00000000 ____D () C:\Users\Ingrid\Desktop\Neuer Ordner
2014-11-29 18:48 - 2013-10-25 14:39 - 00000000 ____D () C:\Program Files (x86)\fotokasten comfort

Some content of TEMP:
====================
C:\Users\Ingrid\AppData\Local\Temp\avgnt.exe
C:\Users\Ingrid\AppData\Local\Temp\Quarantine.exe
C:\Users\Ingrid\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Ingrid\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-22 20:01

==================== End Of Log ============================
         
Additional
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-12-2014 01
Ran by Ingrid at 2014-12-22 20:08:19
Running from C:\Users\Ingrid\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda Internet Security 2015 (Enabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Internet Security 2015 (Enabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Absolute Uninstaller 5.3.1.7 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.7 - Glarysoft Ltd)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4489 - APN, LLC)
Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
Behind The Reflection 2: Witch's Revenge (x32 Version: 3.0.2.32 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.223.181 - Broadcom Corporation)
Broadcom Wireless Utility (HKLM\...\{4CDA59B9-7AD3-4283-9F5C-BC469FF975B6}) (Version: 6.30.59.132 - Broadcom Corporation)
Build-a-lot: On Vacation (x32 Version: 2.2.0.110 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cut the Rope (x32 Version: 3.0.2.38 - WildTangent) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.0.2529 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.6426.52 - CyberLink Corp.)
Einstellungen für VAIO Media Server (HKLM\...\{62A172B2-550E-499D-9A82-5190D18390AA}) (Version: 1.1.0.02220 - Sony Corporation)
Enchanted Cavern 2 (x32 Version: 2.2.0.110 - WildTangent) Hidden
ESDL (x32 Version: 1.0.0 - Sony Corporation) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
FDUx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
fotokasten comfort 5.0 (HKLM-x32\...\fotokasten comfort_is1) (Version:  - )
Glary Utilities 5.8 (HKLM-x32\...\Glary Utilities 5) (Version: 5.8.0.15 - Glarysoft Ltd)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Heroes of Hellas 3: Athens (x32 Version: 3.0.2.32 - WildTangent) Hidden
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41800) (Version: 3.8.0.41800.66 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) PROSet/Wireless NFC-Software (HKLM\...\Intel(R) PROSet/Wireless NFC-Software) (Version: 1.1.1.003 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Java 7 Update 13 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417013FF}) (Version: 7.0.130 - Oracle)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Luxor HD (x32 Version: 2.2.0.110 - WildTangent) Hidden
Mahjongg Artifacts (x32 Version: 2.2.0.110 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
My Kingdom for the Princess 3 (x32 Version: 2.2.0.110 - WildTangent) Hidden
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Opera Stable 26.0.1656.60 (HKLM-x32\...\Opera 26.0.1656.60) (Version: 26.0.1656.60 - Opera Software ASA)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.03 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Internet Security 2015 (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.03.0000 - Panda Security)
Panda Internet Security 2015 (Version: 7.23.00.0000 - Panda Security) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayMemories Home (HKLM-x32\...\{1E5C7043-09C5-4974-A69F-A5271FD82BBC}) (Version: 7.0.02.14060 - Sony Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.28145 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.10.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7177 - Realtek Semiconductor Corp.)
Restore (x32 Version: 1.0.0 - Sony Corporation) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
SSLx64 (Version: 1.0.0 - Sony Corporation ) Hidden
SSLx86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.2.4 - Synaptics Incorporated)
T-Online 6.0 (HKLM-x32\...\{B1275E23-717A-4D52-997A-1AD1E24BC7F3}) (Version:  - )
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
VAIO - Xperia Link (HKLM-x32\...\{D91558BF-D1F3-411F-AEFE-8774CB406512}) (Version: 1.3.2.07020 - Sony Corporation)
VAIO BIOS Data Transfer Utility (x32 Version: 1.0.0.02050 - Sony Corporation) Hidden
VAIO Care (HKLM\...\{92907606-B2FC-4193-B0CE-A21159DA3ABB}) (Version: 8.4.0.14286 - Sony Corporation)
VAIO Care Recovery (HKLM\...\{15B9204E-BA09-485E-8F2C-094AC0077664}) (Version: 1.1.2.13230 - Sony Corporation)
VAIO Care-Hardwarediagnose-Plugin (HKLM-x32\...\{EC153498-00E1-4C9C-89BE-81527C6750BE}) (Version: 4.11.1.11210 - Sony Corporation)
VAIO Control Center (HKLM-x32\...\{8E797841-A110-41FD-B17A-3ABC0641187A}) (Version: 6.2.0.03070 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.11.0.13250 - Sony Corporation)
VAIO Easy Connect (x32 Version: 8.2.0.14170 - Sony Corporation) Hidden
VAIO Gesture Control (HKLM-x32\...\{692955F2-DE9F-4078-8FAA-858D6F3A1776}) (Version: 2.2.0.01230 - Sony Corporation)
VAIO Gesture Control (x32 Version: 2.2.0.01230 - Sony Corporation) Hidden
VAIO Image Optimizer (HKLM-x32\...\InstallShield_{5597C927-029A-46A7-A0C0-8DABD9891A50}) (Version: 3.3.00.10220 - Sony Corporation)
VAIO Image Optimizer (x32 Version: 3.1.00.14260 - Sony Corporation) Hidden
VAIO Improvement (HKLM-x32\...\{3A26D9BD-0F73-432D-B522-2BA18138F7EF}) (Version: 2.2.0.01240 - Sony Corporation)
VAIO Movie Creator (HKLM-x32\...\InstallShield_{C2CC5822-32E6-4D21-88EA-DE8CED09EE2F}) (Version: 4.3.01.11140 - Sony Corporation)
VAIO Movie Creator (x32 Version: 4.1.01.15140 - Sony Corporation) Hidden
VAIO Sample Music (HKLM-x32\...\{FBEE3D44-0933-4B84-BB6A-49957F89187F}) (Version: 1.0.0.03051 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.0.1.02280 - Sony Corporation)
VAIO*CPU-Lüfterdiagnose (HKLM-x32\...\{BCE6E3D7-B565-4E1B-AC77-F780666A35FB}) (Version: 1.2.0.03050 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.9.0.11060 - Sony Corporation)
VCCx64 (Version: 1.0.0 - Sony Corporation) Hidden
VCCx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VHD (x32 Version: 1.0.0 - Sony Corporation) Hidden
Virtual Villagers 5 - New Believers (x32 Version: 3.0.2.32 - WildTangent) Hidden
VIx64 (Version: 1.0.0 - Sony Corporation) Hidden
VIx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VPMx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VSSTx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VSSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
VWSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.7850 - Broadcom Corporation)
WildTangent Games App (x32 Version: 4.0.10.5 - WildTangent) Hidden
WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
XperiaLinkx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2085259247-1724912421-3600129739-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AC}\InprocServer32 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)
CustomCLSID: HKU\S-1-5-21-2085259247-1724912421-3600129739-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AD}\InprocServer32 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)

==================== Restore Points  =========================

28-11-2014 20:24:01 Windows Update
06-12-2014 13:25:44 Geplanter Prüfpunkt
13-12-2014 12:58:34 Windows Update
21-12-2014 11:03:40 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0C6CB9CE-7B8B-4129-94ED-6E4B03E7C097} - System32\Tasks\Sony Corporation\VAIO Care\UpdateContacts => %ProgramData%\Sony Corporation\VAIO Care\UpdateContacts.exe
Task: {19544D59-8D96-4C65-BB4B-501B75D227E7} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2013-02-02] (Sony Corporation)
Task: {224D0DAB-0DD7-4C7D-B736-7D9A202E6186} - System32\Tasks\Sony Corporation\VAIO Care\CheckSystemInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {29D10A88-294F-40BE-AD21-4E7D1E58E65F} - System32\Tasks\Sony Corporation\VAIO Care\GetPOTInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {39EA82D8-7D93-4685-8702-06D5D6CDC5FF} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {39FBB007-3B2C-4D68-9C9A-C8F7F9C1581F} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2012-07-24] (CyberLink Corp.)
Task: {40237D0D-5D49-4049-B8B5-C467B49A7FDC} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {40CCDF73-358E-45D1-80DD-899EA762B4C9} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
Task: {43B4E078-EFE5-415D-AD7C-52677392F6BC} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-13] (Adobe Systems Incorporated)
Task: {6653C03E-3FA6-407A-8CE7-5F4794718F66} - System32\Tasks\Sony Corporation\Xperia Link\Xperia Link Logon Start => C:\Program Files (x86)\Sony\Xperia Link\Xperia Link.exe [2014-07-03] (Sony Corporation)
Task: {73C4AA26-0CB4-47CC-8E0C-8B43E5175B3E} - System32\Tasks\USER_ESRV_SVC => Wscript.exe //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"
Task: {7FB64ECF-72FE-4C88-AB7C-FFDA995A4942} - System32\Tasks\SuperEasyDriverUpdaterRunAtStartup => C:\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe
Task: {846336FF-57A6-426B-8621-BE79499C0D66} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterUser => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-03-08] (Sony Corporation)
Task: {84A19715-A577-4D59-97EA-57A8FB649DB5} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2013-02-02] (Sony Corporation)
Task: {85D7091B-7939-4076-BB35-311112EDF166} - System32\Tasks\Sony Corporation\VAIO Care\UpdateSolution => C:\Program Files\Sony\VAIO Care\Solution.Updater.exe [2014-02-27] (Sony Corporation)
Task: {8BFC1F0A-504A-4138-858C-8256014676F3} - System32\Tasks\Opera scheduled Autoupdate 1412511148 => C:\Program Files (x86)\Opera\launcher.exe [2014-12-17] (Opera Software)
Task: {8D24F82A-FFAB-49B3-A702-5B76B702168C} - System32\Tasks\Sony Corporation\VAIO Care\VCRLog => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {95D06779-7EDD-4A7E-B21C-7D305DBB6C82} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {99CF6432-9D13-47AD-A7B1-C32582B4CED4} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {9D36F34D-12BB-4505-B0BC-E236950850EA} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2013-01-24] (Sony Corporation)
Task: {9ED7C5FC-C810-495D-A838-FFC94B58270C} - System32\Tasks\Sony Corporation\VAIO Control Center\NetworkSetting\NetworkSetting Logon Start => C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient
Task: {A839DF5E-A1F1-45B8-AE8A-6B3E2CC8A04F} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {A92688FA-33CA-476B-B647-FBBF76C4CB86} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterSystem => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-03-08] (Sony Corporation)
Task: {AF110045-01DB-4826-B498-E58BBE1A7342} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BF381DF4-F40E-4C76-BFDC-13E8C937DEF5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-13] (Microsoft Corporation)
Task: {C388FE4A-3C17-4F99-B0D1-7D2C23BDED2C} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2014-03-01] (Sony Corporation)
Task: {C40FDEFB-0084-4FCC-833F-295F0E584726} - System32\Tasks\Sony Corporation\VAIO Gesture Control\VCGULogonTask => C:\Program Files (x86)\Sony\VAIO Camera Gesture Utility\VCGU.exe [2013-01-23] (Sony Corporation)
Task: {C552DF55-5E63-440F-97B0-76840DDDB1C1} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2014-09-15] (Glarysoft Ltd)
Task: {D89ABF58-B4F8-4771-8595-C804BE3BD901} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-01] (Google Inc.)
Task: {DEDE8CA4-990F-42CA-8BBB-B913EE648F39} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-01] (Google Inc.)
Task: {E61948E0-1458-4787-B196-6828D94D3A37} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {E961F616-6FB1-45DE-9850-81CD8AEE9F7D} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2014-02-28] (Sony Corporation)
Task: {EE946453-3B94-4E57-BA4B-BEA4C6F0F11A} - System32\Tasks\Sony Corporation\VAIO Care\DeployCRMflag => C:\Program Files\Sony\VAIO Care\DeployCRMflag.exe [2014-01-16] (Sony Corporation)
Task: {FFD6D0C8-C395-480A-ACDA-B48D2F343070} - System32\Tasks\Sony Corporation\VAIO Care\UploadPOT => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) =============

2008-09-09 10:22 - 2008-09-09 10:22 - 00022016 _____ () C:\WINDOWS\System32\sst1cl6.dll
2013-09-04 19:13 - 2013-09-04 19:13 - 00049368 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-01-29 23:02 - 2014-01-29 23:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-11-19 09:21 - 2013-11-19 09:21 - 00062464 _____ () C:\Program Files\Sony\VAIO Care\listener.exe
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files (x86)\Panda Security\Panda Security Protection\SQLite3.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-05-25 06:43 - 2013-01-23 10:26 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-12-09 19:22 - 2014-12-09 19:22 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Ingrid\SkyDrive:ms-properties
AlternateDataStreams: C:\Users\Ingrid\Downloads\12_09_2014_KSI_Bad_Honnef.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\ABB-Veranstaltung_KSI_12_09_2014(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\ABB-Veranstaltung_KSI_12_09_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Advz_5562522_Advanzia_Bank_S_A.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Baby_Watching.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Best_tigung_Ihrer_Reservierung_auf_Flugladen_de_-_nr_FL-5548916.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\E-Mail_schreiben_an_Beurteilung_Mathe_4.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Einladung_zum_Fachtag_Grundschule_Bonn.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Einladung_zur_gemeinsamen_Sitzung_der_R_te_am_Mittwoch_05_11_14_20h.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Fertiger_Entwurf.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Formulierungen_fwd.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Fwd_Envoi_d_un_message_Arbre_photo_Vincent_pdf(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Fwd_Envoi_d_un_message_Arbre_photo_Vincent_pdf.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Geb_hrenfrei_MasterCard_Gold_-_Rechnung_03_12_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Geb_hrenfrei_MasterCard_Gold_Herzlich_Willkommen.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Hallo_Herbst.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Herzlich_willkommen_bei_Zisch.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihre_IGH-Wollversand_Onlineshop_Bestellung_wurde_versandt.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihre_neue_Kreditkarte_-_CHECK24.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihr_CHECK24_Reise-Gutschein.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihr_ERGO_Direkt_Versicherungs-Angebot_Herr_Ziegler.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Klassenpflegschaft.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\message(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\message.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Newsletter_September_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Opodo_Fluggutscheine_im_Wert_von_5_10_und_15_Euro.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Praxissemester.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Lehrerkonferenz(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Lehrerkonferenz(2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Lehrerkonferenz.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Schulkonferenz.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_Dezember_2014_Buchungskonto_4736946773.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_Oktober_2014_Buchungskonto_4736946773.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_September_2014_Buchungskonto_4736946773(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_September_2014_Buchungskonto_4736946773(2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_September_2014_Buchungskonto_4736946773.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Re_AW_Treffen_in_Bonn.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Re_hui.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Re_STRATO_AG_-_Ihr_Supportauftrag_vom_07_11_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\R_351_Stolberg-Donnerberg_-_Bewertung_am_11_10_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\STRATO_AG_K_ndigungsbest_tigung_zu_Ihrer_Kundennummer_63092954.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Unterlagen_zur_Erstellung_von_BB_und_LZB(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Unterlagen_zur_Erstellung_von_BB_und_LZB.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Vielen_Dank_f_r_die_Geschenke_-.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Vielen_Dank_f_r_Ihre_Bestellung_vom_15_Oktober_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\WDR_Abenteuerreise_-_Einladu_ng_f_r_Mittwoch_10_12_2014_um_10.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\WG_F_rderplan.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Zisch_Neues_Informationsmaterial_f_r_Sie_und_Ihre_Sch_ler.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Zusendung_Ihrer_Geb_hrenfrei_MasterCard_Gold.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "PSUAMain"

========================= Accounts: ==========================

Administrator (S-1-5-21-2085259247-1724912421-3600129739-500 - Administrator - Disabled)
Gast (S-1-5-21-2085259247-1724912421-3600129739-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2085259247-1724912421-3600129739-1005 - Limited - Enabled)
Ingrid (S-1-5-21-2085259247-1724912421-3600129739-1001 - Administrator - Enabled) => C:\Users\Ingrid

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/22/2014 07:49:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wwahost.exe, Version 6.3.9600.17031 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1bb0

Startzeit: 01d01e1746bac64d

Endzeit: 4294967295

Anwendungspfad: C:\WINDOWS\syswow64\wwahost.exe

Berichts-ID: 3b1ebdad-8a0b-11e4-bec6-b8763fb46214

Vollständiger Name des fehlerhaften Pakets: Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5c

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (12/22/2014 07:38:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: VCSystemTray.exe, Version: 8.4.0.14200, Zeitstempel: 0x53056230
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebf2e
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000606c
ID des fehlerhaften Prozesses: 0x1888
Startzeit der fehlerhaften Anwendung: 0xVCSystemTray.exe0
Pfad der fehlerhaften Anwendung: VCSystemTray.exe1
Pfad des fehlerhaften Moduls: VCSystemTray.exe2
Berichtskennung: VCSystemTray.exe3
Vollständiger Name des fehlerhaften Pakets: VCSystemTray.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: VCSystemTray.exe5

Error: (12/22/2014 07:38:35 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCSystemTray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ComponentModel.Composition.ImportCardinalityMismatchException
Stapel:
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExports(System.ComponentModel.Composition.Primitives.ImportDefinition, System.ComponentModel.Composition.Hosting.AtomicComposition)
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality)
   bei VCSystemTray.ViewModel.MainWindowViewModel.CollectRSOCData(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.TimerQueueTimer.CallCallback()
   bei System.Threading.TimerQueueTimer.Fire()
   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (12/22/2014 05:43:39 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (12/21/2014 11:27:34 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 8b8

Startzeit: 01d01d080458b77a

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe

Berichts-ID: f7a89c1d-88fb-11e4-bec4-b8763fb46214

Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1

Error: (12/20/2014 10:18:38 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (12/20/2014 11:57:17 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20689 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 10ec

Startzeit: 01d01c43027d29f1

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exe

Berichts-ID: f426baf1-8836-11e4-bec4-b8763fb46214

Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1

Error: (12/20/2014 10:32:08 AM) (Source: SampleCollector) (EventID: 259) (User: )
Description: init_sstates_file:CreateFile:Prev_SState: Failed with error 0x20: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Error: (12/20/2014 03:41:13 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (12/19/2014 02:55:21 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005


System errors:
=============
Error: (12/22/2014 07:15:12 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:12 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:11 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:11 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:11 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:10 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:10 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:10 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:09 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:09 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar


Microsoft Office Sessions:
=========================
Error: (12/22/2014 07:49:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: wwahost.exe6.3.9600.170311bb001d01e1746bac64d4294967295C:\WINDOWS\syswow64\wwahost.exe3b1ebdad-8a0b-11e4-bec6-b8763fb46214Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5cApp

Error: (12/22/2014 07:38:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: VCSystemTray.exe8.4.0.1420053056230KERNELBASE.dll6.3.9600.1727853eebf2ee0434352000000000000606c188801d01e13d5a4b556C:\Program Files\Sony\VAIO Care\VCSystemTray.exeC:\WINDOWS\system32\KERNELBASE.dllc15bfc7e-8a09-11e4-bec6-b8763fb46214

Error: (12/22/2014 07:38:35 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCSystemTray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ComponentModel.Composition.ImportCardinalityMismatchException
Stapel:
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExports(System.ComponentModel.Composition.Primitives.ImportDefinition, System.ComponentModel.Composition.Hosting.AtomicComposition)
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality)
   bei VCSystemTray.ViewModel.MainWindowViewModel.CollectRSOCData(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.TimerQueueTimer.CallCallback()
   bei System.Threading.TimerQueueTimer.Fire()
   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (12/22/2014 05:43:39 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (12/21/2014 11:27:34 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.206898b801d01d080458b77a4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exef7a89c1d-88fb-11e4-bec4-b8763fb46214microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (12/20/2014 10:18:38 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (12/20/2014 11:57:17 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.2068910ec01d01c43027d29f14294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\LiveComm.exef426baf1-8836-11e4-bec4-b8763fb46214microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (12/20/2014 10:32:08 AM) (Source: SampleCollector) (EventID: 259) (User: )
Description: init_sstates_file:CreateFile:Prev_SState: Failed with error 0x20: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Error: (12/20/2014 03:41:13 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (12/19/2014 02:55:21 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005


CodeIntegrity Errors:
===================================
  Date: 2014-10-05 13:43:02.207
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe that did not meet the Store signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU 987 @ 1.50GHz
Percentage of memory in use: 46%
Total physical RAM: 3972.8 MB
Available physical RAM: 2117.5 MB
Total Pagefile: 8068.8 MB
Available Pagefile: 5945.22 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:438.39 GB) (Free:363.26 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 39EC5E17)

Partition: GPT Partition Type.

==================== End Of Log ============================
         


Vielen Dank für eure Hilfe!
Katharina

Alt 23.12.2014, 07:40   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



hi,


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________

__________________

Alt 23.12.2014, 13:56   #3
kaethe_
 
Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



Lieber Schrauber,
vielen Dank für deine schnelle Antwort :-)

Also:
Eset

Code:
ATTFilter
C:\AdwCleaner\Quarantine\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe.vir	Variante von Win32/SpeedingUpMyPC Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe.vir	Variante von Win32/Systweak.H evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZip Malware Protector\AppManager.exe.vir	Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZip Malware Protector\filetypehelper.exe.vir	Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZip Malware Protector\scandll.dll.vir	Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe.vir	Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZip Malware Protector\WMPUninstall.exe.vir	Variante von Win32/Systweak.Q evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default\Extensions\8hffxtbr@Allin1Convert_8h.com\plugins\NativeMessagingDispatcher.dll.vir	Win32/Toolbar.MyWebSearch.AO evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\WINDOWS\System32\roboot64.exe.vir	Variante von Win64/Systweak.A evtl. unerwünschte Anwendung
C:\Users\Ingrid\Downloads\supereasy_driver_updater_1.1.1_7870(1).exe	Variante von Win32/Systweak.H evtl. unerwünschte Anwendung
C:\Users\Ingrid\Downloads\supereasy_driver_updater_1.1.1_7870(2).exe	Variante von Win32/Systweak.H evtl. unerwünschte Anwendung
C:\Users\Ingrid\Downloads\supereasy_driver_updater_1.1.1_7870(3).exe	Variante von Win32/Systweak.H evtl. unerwünschte Anwendung
C:\Users\Ingrid\Downloads\supereasy_driver_updater_1.1.1_7870.exe	Variante von Win32/Systweak.H evtl. unerwünschte Anwendung
C:\Users\Ingrid\Downloads\tamnsp_050805344922427739.exe	Win32/Systweak.K evtl. unerwünschte Anwendung
C:\Users\Ingrid\Downloads\wzmp_8(1).exe	Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
C:\Users\Ingrid\Downloads\wzmp_8.exe	Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-12-2014 01
Ran by Ingrid (administrator) on VAI on 23-12-2014 13:46:13
Running from C:\Users\Ingrid\Downloads
Loaded Profile: Ingrid (Available profiles: Ingrid)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\BCMWLTRY.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\SUSSoundProxy.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\Bluetooth Headset Helper.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-20] (Realtek Semiconductor)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe [10592256 2013-11-09] (Broadcom Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2752752 2013-07-12] (Synaptics Incorporated)
HKLM\...\Run: [Bluetooth] => C:\Program Files\WIDCOMM\Bluetooth Software\bttray.exe [534232 2013-09-04] (Broadcom Corporation.)
HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [740376 2013-02-06] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2013-02-19] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2353880 2013-11-01] (Microsoft Corp.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-07-24] (Panda Security, S.L.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\SYSTEM32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-09-15] (Glarysoft Ltd)
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\...\RunOnce: [Adobe Speed Launcher] => 1419319988
BootExecute: autocheck autochk *  

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://sony13.msn.com
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://vaioportal.sony.eu
HKU\S-1-5-21-2085259247-1724912421-3600129739-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://vaioportal.sony.eu
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2085259247-1724912421-3600129739-1001 -> {19977BDD-E6FC-4A2B-861C-4015A877DE15} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-&_nkw={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\Sony\MSS\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 217.0.43.113 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.13.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files\Sony\MSS\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2085259247-1724912421-3600129739-1001: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll (Intel)
FF Plugin HKU\S-1-5-21-2085259247-1724912421-3600129739-1001: intel.com/AppUpx64 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)
FF Extension: Deutsch (DE) Language Pack - C:\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-05-18]
FF Extension: Search-App - C:\Users\Ingrid\AppData\Roaming\Mozilla\Firefox\Profiles\gb8jmp8j.default\Extensions\{2ec58dc4-24a6-4bfa-8997-204f24f8a1f9}.xpi [2014-10-14]

Chrome: 
=======
CHR DefaultSearchKeyword: Default -> astromenda.com
CHR DefaultSearchURL: Default -> hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggfc_14_40_ie&cd=2XzuyEtN2Y1L1Qzu0B0AyByCtA0F0ByEyCtBtCtAzz0CyCyBtN0D0Tzu0StCtDtDzztN1L2XzutAtFyDtFtCtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCtDyCtCtD0CtByEtG0C0Azy0FtGyC0B0F0AtG0DzyyDtDtGtCyC0D0F0EtB0AtByB0F0C0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0C0AtByCyE0EyBzztGzyzyzz0DtGyEyCtDtCtG0A0A0EyDtGtA0DyBtBtBzztAyDyB0F0C0C2Q&cr=1985374833&ir=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-12]
CHR Extension: (Avira Browser Safety) - C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-12]
CHR Extension: (Google Wallet) - C:\Users\Ingrid\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)
R2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-19] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129824 2013-01-23] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166688 2013-01-23] (Intel Corporation)
S3 McComponentHostServiceSony; C:\Program Files\Sony\MSS\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-09-24] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-09-24] (McAfee, Inc.)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [141560 2014-07-24] (Panda Security, S.L.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [629336 2013-09-28] (Sony Corporation)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [61688 2014-07-23] (Panda Security, S.L.)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-02-06] (Sony Corporation)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-07-24] (Panda Security, S.L.)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [266168 2013-11-19] (Intel Corporation)
S3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-19] (Intel Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [972000 2013-01-06] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe [6099968 2013-11-09] (Broadcom Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-12-01] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43064 2014-10-07] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8469680 2013-12-01] (Broadcom Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 cfwids; C:\Windows\system32\drivers\cfwids.sys [70112 2013-09-24] (McAfee, Inc.)
S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2014-12-22] (Emsisoft GmbH)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 GUBootStartup; C:\WINDOWS\System32\drivers\GUBootStartup.sys [20672 2014-09-21] (Glarysoft Ltd)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-22] (Malwarebytes Corporation)
S3 mfeapfk; C:\Windows\system32\drivers\mfeapfk.sys [179664 2013-09-24] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-09-24] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69264 2013-09-24] (McAfee, Inc.)
R3 mfefirek; C:\Windows\system32\drivers\mfefirek.sys [519192 2013-09-24] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [781312 2013-09-24] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [95984 2013-09-20] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-09-24] (McAfee, Inc.)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [160800 2014-07-24] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [120352 2014-07-24] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [106016 2014-07-24] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 semav6thermal64ro; C:\WINDOWS\system32\drivers\semav6thermal64ro.sys [13792 2014-05-12] ()
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-07-12] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-23 13:39 - 2014-12-23 13:40 - 00852505 _____ () C:\Users\Ingrid\Downloads\SecurityCheck.exe
2014-12-23 08:38 - 2014-12-23 08:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-12-23 08:37 - 2014-12-23 08:38 - 02347384 _____ (ESET) C:\Users\Ingrid\Downloads\esetsmartinstaller_deu.exe
2014-12-22 20:51 - 2014-12-22 20:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-12-22 20:51 - 2014-12-22 20:51 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-12-22 20:50 - 2014-12-22 20:50 - 01180834 _____ () C:\Users\Ingrid\Downloads\7z935.exe
2014-12-22 20:08 - 2014-12-22 20:09 - 00042489 _____ () C:\Users\Ingrid\Downloads\Addition.txt
2014-12-22 20:06 - 2014-12-23 13:47 - 00023211 _____ () C:\Users\Ingrid\Downloads\FRST.txt
2014-12-22 20:06 - 2014-12-23 13:46 - 00000000 ____D () C:\FRST
2014-12-22 19:34 - 2014-12-22 19:34 - 00380416 _____ () C:\Users\Ingrid\Downloads\Gmer-19357.exe
2014-12-22 19:33 - 2014-12-22 19:34 - 00602112 _____ (OldTimer Tools) C:\Users\Ingrid\Downloads\OTL.exe
2014-12-22 19:32 - 2014-12-22 19:33 - 02122240 _____ (Farbar) C:\Users\Ingrid\Downloads\FRST64.exe
2014-12-22 19:12 - 2014-12-23 13:45 - 00000000 ____D () C:\Users\Ingrid\Desktop\Trojaner board
2014-12-22 19:06 - 2014-12-22 19:06 - 02173952 _____ () C:\Users\Ingrid\Downloads\AdwCleaner_4.106.exe
2014-12-22 18:18 - 2014-12-22 18:24 - 00000000 ____D () C:\EEK
2014-12-22 18:18 - 2014-12-22 18:18 - 00000755 _____ () C:\Users\Ingrid\Desktop\Start Emsisoft Emergency Kit.lnk
2014-12-22 17:46 - 2014-12-22 18:16 - 163414032 _____ () C:\Users\Ingrid\Downloads\EmsisoftEmergencyKit.exe
2014-12-22 14:49 - 2014-12-22 14:49 - 00167669 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141222(1).zip
2014-12-22 14:47 - 2014-12-22 14:48 - 00329820 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141222.zip
2014-12-20 12:08 - 2014-12-20 12:13 - 25079726 _____ () C:\Users\Ingrid\Documents\kragen.htm
2014-12-20 12:01 - 2014-12-20 12:05 - 25079726 _____ () C:\Users\Ingrid\Downloads\70148775.zip
2014-12-16 18:28 - 2014-12-16 18:28 - 00282518 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141216.zip
2014-12-15 14:19 - 2014-12-15 14:19 - 00283528 _____ () C:\WINDOWS\Minidump\121514-44531-01.dmp
2014-12-15 14:18 - 2014-12-15 14:18 - 412850640 _____ () C:\WINDOWS\MEMORY.DMP
2014-12-13 17:12 - 2014-11-26 22:10 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-12-13 17:12 - 2014-11-26 22:10 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-13 17:02 - 2014-12-13 17:02 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-13 16:03 - 2014-12-13 16:03 - 00000000 __SHD () C:\Users\Ingrid\AppData\Local\EmieBrowserModeList
2014-12-11 17:37 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-11 17:37 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-11 17:37 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-11 17:37 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-11 17:37 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-11 17:36 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-11 17:36 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-11 17:36 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-11 17:36 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-11 17:10 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-11 17:10 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-11 17:10 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-11 17:10 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2014-12-11 17:06 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-11 17:06 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-11 17:05 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 17:05 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-11 17:04 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-11 17:04 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-11 17:04 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-11 17:04 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-11 17:04 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-11 17:04 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-11 17:04 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-11 17:04 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-11 17:04 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-11 17:04 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-11 17:04 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-11 17:04 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-11 17:03 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-11 17:03 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-11 17:03 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-11 17:03 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-11 17:03 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-11 17:03 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-11 17:03 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-11 17:03 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-11 17:03 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-11 17:03 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-11 17:03 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-11 17:03 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-11 17:03 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-11 17:03 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-11 17:03 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-11 17:03 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-11 17:03 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-11 17:03 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-11 17:03 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-11 17:03 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-11 17:03 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-11 17:03 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-11 17:03 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-11 17:03 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-11 17:03 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-11 17:03 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-11 17:03 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 20:49 - 2014-12-10 20:51 - 09547145 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141210.zip
2014-12-09 19:22 - 2014-12-09 19:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-05 16:29 - 2014-12-05 16:30 - 01037134 _____ () C:\Users\Ingrid\Downloads\gsm20090660_pfefferkuchenmann.zip
2014-12-05 16:12 - 2014-12-05 16:12 - 00115918 _____ () C:\Users\Ingrid\Downloads\Geb_hrenfrei_MasterCard_Gold_-_Rechnung_03_12_2014.eml
2014-12-02 17:41 - 2014-12-02 17:41 - 00249955 _____ () C:\Users\Ingrid\Downloads\RechnungOnline_Monat_Dezember_2014_Buchungskonto_4736946773.eml
2014-12-02 15:16 - 2014-12-02 15:16 - 00262269 _____ () C:\Users\Ingrid\Documents\E-Mail.htm12.htm
2014-12-02 15:16 - 2014-12-02 15:16 - 00000000 ____D () C:\Users\Ingrid\Documents\E-Mail.htm12-Dateien
2014-12-01 18:35 - 2014-12-01 18:35 - 00219847 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141201.zip
2014-11-30 15:26 - 2014-11-30 15:26 - 00061338 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141130.zip
2014-11-30 13:09 - 2014-11-30 13:20 - 00279663 _____ () C:\Users\Ingrid\Downloads\pcSelectLayout.do.part
2014-11-29 19:54 - 2014-11-29 19:56 - 00000921 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141129.zip
2014-11-29 19:06 - 2014-11-29 19:06 - 00000722 _____ () C:\Users\Ingrid\Documents\Warenkorb.psc
2014-11-29 19:06 - 2014-11-29 19:06 - 00000000 ____D () C:\Users\Ingrid\Documents\Warenkorb-Dateien
2014-11-29 18:56 - 2014-12-02 17:44 - 00000000 ____D () C:\Users\Ingrid\Documents\Postkarte Set(12 Stk.) 148x105 mm-Dateien
2014-11-29 18:56 - 2014-11-29 18:56 - 00010363 _____ () C:\Users\Ingrid\Documents\Postkarte Set(12 Stk.) 148x105 mm.pcf
2014-11-28 17:06 - 2014-11-28 17:06 - 00161660 _____ () C:\Users\Ingrid\Downloads\Anhänge_20141128.zip
2014-11-26 21:53 - 2014-11-26 21:53 - 01707532 _____ (Thisisu) C:\Users\Ingrid\Downloads\JRT(1).exe
2014-11-26 21:50 - 2014-11-26 21:50 - 02148864 _____ () C:\Users\Ingrid\Downloads\AdwCleaner_4.102(1).exe
2014-11-26 21:25 - 2014-11-26 21:25 - 02148864 _____ () C:\Users\Ingrid\Downloads\AdwCleaner_4.102.exe
2014-11-26 20:13 - 2014-11-26 20:16 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Ingrid\Downloads\mbam-setup-2.0.3.1025.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-23 13:48 - 2013-09-28 17:53 - 00000000 ____D () C:\Users\Ingrid\AppData\Roaming\Skype
2014-12-23 13:09 - 2014-04-15 19:16 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-12-23 13:08 - 2013-12-01 18:25 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-23 13:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-12-23 08:54 - 2013-09-28 14:34 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2085259247-1724912421-3600129739-1001
2014-12-23 08:42 - 2014-04-10 10:39 - 01321689 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-23 08:35 - 2014-05-19 16:56 - 00003914 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{11CC6469-67D9-4BA3-9306-FCB687CE1FAA}
2014-12-23 08:33 - 2014-04-10 10:51 - 00000000 ___DO () C:\Users\Ingrid\SkyDrive
2014-12-23 08:32 - 2014-09-21 16:55 - 00000342 _____ () C:\WINDOWS\Tasks\GlaryInitialize 5.job
2014-12-23 08:32 - 2014-04-10 10:16 - 00000000 ____D () C:\Users\Ingrid
2014-12-23 08:32 - 2013-12-01 18:25 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-23 08:31 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-22 19:19 - 2014-04-10 09:25 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-22 19:13 - 2013-11-13 23:18 - 00324992 _____ () C:\WINDOWS\PFRO.log
2014-12-22 19:13 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-12-22 19:12 - 2014-08-05 19:11 - 00000000 ____D () C:\AdwCleaner
2014-12-22 18:57 - 2014-10-02 15:32 - 00003196 _____ () C:\WINDOWS\System32\Tasks\SuperEasyDriverUpdaterRunAtStartup
2014-12-21 11:48 - 2014-03-15 18:58 - 00117760 ___SH () C:\Users\Ingrid\Documents\Thumbs.db
2014-12-21 11:11 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-12-21 11:04 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-20 17:05 - 2013-11-14 08:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-12-20 17:05 - 2013-11-14 08:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-12-20 17:05 - 2013-11-14 08:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-12-18 19:54 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-17 17:03 - 2014-10-05 13:12 - 00003842 _____ () C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1412511148
2014-12-17 17:03 - 2014-10-05 13:12 - 00001057 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-12-17 17:03 - 2014-10-05 13:12 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-16 16:06 - 2014-10-16 15:25 - 00001153 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-16 16:06 - 2013-09-28 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-16 16:06 - 2013-09-28 15:27 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-16 16:06 - 2013-05-25 06:41 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-15 14:19 - 2014-11-09 16:54 - 00000000 ____D () C:\WINDOWS\Minidump
2014-12-15 13:57 - 2013-08-22 15:46 - 00313638 _____ () C:\WINDOWS\setupact.log
2014-12-14 13:17 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-13 17:09 - 2014-04-10 11:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-13 17:02 - 2014-07-26 16:01 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-13 17:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-13 17:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-13 17:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-13 16:55 - 2013-12-31 15:31 - 00647168 ___SH () C:\Users\Ingrid\Desktop\Thumbs.db
2014-12-13 16:03 - 2014-06-30 16:05 - 00000000 ____D () C:\Users\Ingrid\AppData\Local\Adobe
2014-12-13 16:02 - 2014-04-15 19:16 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-13 13:18 - 2013-12-05 19:59 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-13 13:15 - 2013-10-17 16:18 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-13 13:08 - 2013-10-17 16:18 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-10 16:23 - 2013-05-25 07:22 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-08 14:22 - 2014-01-02 15:40 - 00000000 ____D () C:\Users\Ingrid\Desktop\Katharina_Bachelor
2014-12-06 13:12 - 2014-09-27 20:58 - 00000000 ____D () C:\Users\Ingrid\Desktop\Fotos Katharina
2014-12-06 12:00 - 2014-09-27 21:15 - 00000000 ____D () C:\Users\Ingrid\Documents\Outlook-Dateien
2014-12-06 11:14 - 2014-05-23 11:00 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-06 11:14 - 2014-04-10 09:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-06 11:14 - 2014-04-10 09:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-02 17:35 - 2014-07-08 16:07 - 00000000 ____D () C:\Users\Ingrid\Desktop\Neuer Ordner
2014-11-29 18:48 - 2013-10-25 14:39 - 00000000 ____D () C:\Program Files (x86)\fotokasten comfort

Some content of TEMP:
====================
C:\Users\Ingrid\AppData\Local\Temp\avgnt.exe
C:\Users\Ingrid\AppData\Local\Temp\Quarantine.exe
C:\Users\Ingrid\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Ingrid\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-23 08:54

==================== End Of Log ============================
         
--- --- ---



Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-12-2014 01
Ran by Ingrid at 2014-12-23 13:48:59
Running from C:\Users\Ingrid\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda Internet Security 2015 (Enabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Internet Security 2015 (Enabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.35 beta (HKLM-x32\...\7-Zip) (Version:  - )
Absolute Uninstaller 5.3.1.7 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.7 - Glarysoft Ltd)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4489 - APN, LLC)
Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
Behind The Reflection 2: Witch's Revenge (x32 Version: 3.0.2.32 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.223.181 - Broadcom Corporation)
Broadcom Wireless Utility (HKLM\...\{4CDA59B9-7AD3-4283-9F5C-BC469FF975B6}) (Version: 6.30.59.132 - Broadcom Corporation)
Build-a-lot: On Vacation (x32 Version: 2.2.0.110 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cut the Rope (x32 Version: 3.0.2.38 - WildTangent) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.0.2529 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.6426.52 - CyberLink Corp.)
Einstellungen für VAIO Media Server (HKLM\...\{62A172B2-550E-499D-9A82-5190D18390AA}) (Version: 1.1.0.02220 - Sony Corporation)
Enchanted Cavern 2 (x32 Version: 2.2.0.110 - WildTangent) Hidden
ESDL (x32 Version: 1.0.0 - Sony Corporation) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
FDUx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
fotokasten comfort 5.0 (HKLM-x32\...\fotokasten comfort_is1) (Version:  - )
Glary Utilities 5.8 (HKLM-x32\...\Glary Utilities 5) (Version: 5.8.0.15 - Glarysoft Ltd)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Heroes of Hellas 3: Athens (x32 Version: 3.0.2.32 - WildTangent) Hidden
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41800) (Version: 3.8.0.41800.66 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) PROSet/Wireless NFC-Software (HKLM\...\Intel(R) PROSet/Wireless NFC-Software) (Version: 1.1.1.003 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Java 7 Update 13 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417013FF}) (Version: 7.0.130 - Oracle)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Luxor HD (x32 Version: 2.2.0.110 - WildTangent) Hidden
Mahjongg Artifacts (x32 Version: 2.2.0.110 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
My Kingdom for the Princess 3 (x32 Version: 2.2.0.110 - WildTangent) Hidden
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
Opera Stable 26.0.1656.60 (HKLM-x32\...\Opera 26.0.1656.60) (Version: 26.0.1656.60 - Opera Software ASA)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.03 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Internet Security 2015 (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.03.0000 - Panda Security)
Panda Internet Security 2015 (Version: 7.23.00.0000 - Panda Security) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayMemories Home (HKLM-x32\...\{1E5C7043-09C5-4974-A69F-A5271FD82BBC}) (Version: 7.0.02.14060 - Sony Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.28145 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.10.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7177 - Realtek Semiconductor Corp.)
Restore (x32 Version: 1.0.0 - Sony Corporation) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
SSLx64 (Version: 1.0.0 - Sony Corporation ) Hidden
SSLx86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.2.4 - Synaptics Incorporated)
T-Online 6.0 (HKLM-x32\...\{B1275E23-717A-4D52-997A-1AD1E24BC7F3}) (Version:  - )
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
VAIO - Xperia Link (HKLM-x32\...\{D91558BF-D1F3-411F-AEFE-8774CB406512}) (Version: 1.3.2.07020 - Sony Corporation)
VAIO BIOS Data Transfer Utility (x32 Version: 1.0.0.02050 - Sony Corporation) Hidden
VAIO Care (HKLM\...\{92907606-B2FC-4193-B0CE-A21159DA3ABB}) (Version: 8.4.0.14286 - Sony Corporation)
VAIO Care Recovery (HKLM\...\{15B9204E-BA09-485E-8F2C-094AC0077664}) (Version: 1.1.2.13230 - Sony Corporation)
VAIO Care-Hardwarediagnose-Plugin (HKLM-x32\...\{EC153498-00E1-4C9C-89BE-81527C6750BE}) (Version: 4.11.1.11210 - Sony Corporation)
VAIO Control Center (HKLM-x32\...\{8E797841-A110-41FD-B17A-3ABC0641187A}) (Version: 6.2.0.03070 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.11.0.13250 - Sony Corporation)
VAIO Easy Connect (x32 Version: 8.2.0.14170 - Sony Corporation) Hidden
VAIO Gesture Control (HKLM-x32\...\{692955F2-DE9F-4078-8FAA-858D6F3A1776}) (Version: 2.2.0.01230 - Sony Corporation)
VAIO Gesture Control (x32 Version: 2.2.0.01230 - Sony Corporation) Hidden
VAIO Image Optimizer (HKLM-x32\...\InstallShield_{5597C927-029A-46A7-A0C0-8DABD9891A50}) (Version: 3.3.00.10220 - Sony Corporation)
VAIO Image Optimizer (x32 Version: 3.1.00.14260 - Sony Corporation) Hidden
VAIO Improvement (HKLM-x32\...\{3A26D9BD-0F73-432D-B522-2BA18138F7EF}) (Version: 2.2.0.01240 - Sony Corporation)
VAIO Movie Creator (HKLM-x32\...\InstallShield_{C2CC5822-32E6-4D21-88EA-DE8CED09EE2F}) (Version: 4.3.01.11140 - Sony Corporation)
VAIO Movie Creator (x32 Version: 4.1.01.15140 - Sony Corporation) Hidden
VAIO Sample Music (HKLM-x32\...\{FBEE3D44-0933-4B84-BB6A-49957F89187F}) (Version: 1.0.0.03051 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.0.1.02280 - Sony Corporation)
VAIO*CPU-Lüfterdiagnose (HKLM-x32\...\{BCE6E3D7-B565-4E1B-AC77-F780666A35FB}) (Version: 1.2.0.03050 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.9.0.11060 - Sony Corporation)
VCCx64 (Version: 1.0.0 - Sony Corporation) Hidden
VCCx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VHD (x32 Version: 1.0.0 - Sony Corporation) Hidden
Virtual Villagers 5 - New Believers (x32 Version: 3.0.2.32 - WildTangent) Hidden
VIx64 (Version: 1.0.0 - Sony Corporation) Hidden
VIx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VPMx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VSSTx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VSSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
VWSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.7850 - Broadcom Corporation)
WildTangent Games App (x32 Version: 4.0.10.5 - WildTangent) Hidden
WildTangent-Spiele (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
XperiaLinkx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2085259247-1724912421-3600129739-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AC}\InprocServer32 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)
CustomCLSID: HKU\S-1-5-21-2085259247-1724912421-3600129739-1001_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AD}\InprocServer32 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)

==================== Restore Points  =========================

06-12-2014 13:25:44 Geplanter Prüfpunkt
13-12-2014 12:58:34 Windows Update
21-12-2014 11:03:40 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0C6CB9CE-7B8B-4129-94ED-6E4B03E7C097} - System32\Tasks\Sony Corporation\VAIO Care\UpdateContacts => %ProgramData%\Sony Corporation\VAIO Care\UpdateContacts.exe
Task: {180459F4-4CE9-4911-A28D-21C6CF4620CF} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2014-02-28] (Sony Corporation)
Task: {19544D59-8D96-4C65-BB4B-501B75D227E7} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2013-02-02] (Sony Corporation)
Task: {224D0DAB-0DD7-4C7D-B736-7D9A202E6186} - System32\Tasks\Sony Corporation\VAIO Care\CheckSystemInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {29D10A88-294F-40BE-AD21-4E7D1E58E65F} - System32\Tasks\Sony Corporation\VAIO Care\GetPOTInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {39EA82D8-7D93-4685-8702-06D5D6CDC5FF} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {39FBB007-3B2C-4D68-9C9A-C8F7F9C1581F} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2012-07-24] (CyberLink Corp.)
Task: {40237D0D-5D49-4049-B8B5-C467B49A7FDC} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {40CCDF73-358E-45D1-80DD-899EA762B4C9} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
Task: {43B4E078-EFE5-415D-AD7C-52677392F6BC} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-13] (Adobe Systems Incorporated)
Task: {6653C03E-3FA6-407A-8CE7-5F4794718F66} - System32\Tasks\Sony Corporation\Xperia Link\Xperia Link Logon Start => C:\Program Files (x86)\Sony\Xperia Link\Xperia Link.exe [2014-07-03] (Sony Corporation)
Task: {73C4AA26-0CB4-47CC-8E0C-8B43E5175B3E} - System32\Tasks\USER_ESRV_SVC => Wscript.exe //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"
Task: {7FB64ECF-72FE-4C88-AB7C-FFDA995A4942} - System32\Tasks\SuperEasyDriverUpdaterRunAtStartup => C:\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe
Task: {825D8D5E-16E4-4625-940C-0E5277C4EC55} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-13] (Microsoft Corporation)
Task: {846336FF-57A6-426B-8621-BE79499C0D66} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterUser => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-03-08] (Sony Corporation)
Task: {84A19715-A577-4D59-97EA-57A8FB649DB5} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2013-02-02] (Sony Corporation)
Task: {85D7091B-7939-4076-BB35-311112EDF166} - System32\Tasks\Sony Corporation\VAIO Care\UpdateSolution => C:\Program Files\Sony\VAIO Care\Solution.Updater.exe [2014-02-27] (Sony Corporation)
Task: {8BFC1F0A-504A-4138-858C-8256014676F3} - System32\Tasks\Opera scheduled Autoupdate 1412511148 => C:\Program Files (x86)\Opera\launcher.exe [2014-12-17] (Opera Software)
Task: {8D24F82A-FFAB-49B3-A702-5B76B702168C} - System32\Tasks\Sony Corporation\VAIO Care\VCRLog => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {95D06779-7EDD-4A7E-B21C-7D305DBB6C82} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {99CF6432-9D13-47AD-A7B1-C32582B4CED4} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {9D36F34D-12BB-4505-B0BC-E236950850EA} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2013-01-24] (Sony Corporation)
Task: {9ED7C5FC-C810-495D-A838-FFC94B58270C} - System32\Tasks\Sony Corporation\VAIO Control Center\NetworkSetting\NetworkSetting Logon Start => C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient
Task: {A839DF5E-A1F1-45B8-AE8A-6B3E2CC8A04F} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: {A92688FA-33CA-476B-B647-FBBF76C4CB86} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterSystem => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-03-08] (Sony Corporation)
Task: {AF110045-01DB-4826-B498-E58BBE1A7342} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {C388FE4A-3C17-4F99-B0D1-7D2C23BDED2C} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2014-03-01] (Sony Corporation)
Task: {C40FDEFB-0084-4FCC-833F-295F0E584726} - System32\Tasks\Sony Corporation\VAIO Gesture Control\VCGULogonTask => C:\Program Files (x86)\Sony\VAIO Camera Gesture Utility\VCGU.exe [2013-01-23] (Sony Corporation)
Task: {C552DF55-5E63-440F-97B0-76840DDDB1C1} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2014-09-15] (Glarysoft Ltd)
Task: {D89ABF58-B4F8-4771-8595-C804BE3BD901} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-01] (Google Inc.)
Task: {DEDE8CA4-990F-42CA-8BBB-B913EE648F39} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-01] (Google Inc.)
Task: {E61948E0-1458-4787-B196-6828D94D3A37} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {EE946453-3B94-4E57-BA4B-BEA4C6F0F11A} - System32\Tasks\Sony Corporation\VAIO Care\DeployCRMflag => C:\Program Files\Sony\VAIO Care\DeployCRMflag.exe [2014-01-16] (Sony Corporation)
Task: {FFD6D0C8-C395-480A-ACDA-B48D2F343070} - System32\Tasks\Sony Corporation\VAIO Care\UploadPOT => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-02-20] (Sony Corporation)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) =============

2008-09-09 10:22 - 2008-09-09 10:22 - 00022016 _____ () C:\WINDOWS\System32\sst1cl6.dll
2013-09-04 19:13 - 2013-09-04 19:13 - 00049368 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-11-28 21:28 - 2014-11-28 21:29 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\ErrorReporting.dll
2014-01-29 23:02 - 2014-01-29 23:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-11-19 09:21 - 2013-11-19 09:21 - 00062464 _____ () C:\Program Files\Sony\VAIO Care\listener.exe
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files (x86)\Panda Security\Panda Security Protection\SQLite3.dll
2013-05-25 06:43 - 2013-01-23 10:26 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-12-09 19:22 - 2014-12-09 19:22 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Ingrid\SkyDrive:ms-properties
AlternateDataStreams: C:\Users\Ingrid\Downloads\12_09_2014_KSI_Bad_Honnef.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\ABB-Veranstaltung_KSI_12_09_2014(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\ABB-Veranstaltung_KSI_12_09_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Advz_5562522_Advanzia_Bank_S_A.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Baby_Watching.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Best_tigung_Ihrer_Reservierung_auf_Flugladen_de_-_nr_FL-5548916.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\E-Mail_schreiben_an_Beurteilung_Mathe_4.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Einladung_zum_Fachtag_Grundschule_Bonn.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Einladung_zur_gemeinsamen_Sitzung_der_R_te_am_Mittwoch_05_11_14_20h.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Fertiger_Entwurf.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Formulierungen_fwd.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Fwd_Envoi_d_un_message_Arbre_photo_Vincent_pdf(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Fwd_Envoi_d_un_message_Arbre_photo_Vincent_pdf.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Geb_hrenfrei_MasterCard_Gold_-_Rechnung_03_12_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Geb_hrenfrei_MasterCard_Gold_Herzlich_Willkommen.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Hallo_Herbst.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Herzlich_willkommen_bei_Zisch.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihre_IGH-Wollversand_Onlineshop_Bestellung_wurde_versandt.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihre_neue_Kreditkarte_-_CHECK24.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihr_CHECK24_Reise-Gutschein.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Ihr_ERGO_Direkt_Versicherungs-Angebot_Herr_Ziegler.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Klassenpflegschaft.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\message(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\message.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Newsletter_September_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Opodo_Fluggutscheine_im_Wert_von_5_10_und_15_Euro.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Praxissemester.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Lehrerkonferenz(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Lehrerkonferenz(2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Lehrerkonferenz.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Protokoll_der_Schulkonferenz.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_Dezember_2014_Buchungskonto_4736946773.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_Oktober_2014_Buchungskonto_4736946773.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_September_2014_Buchungskonto_4736946773(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_September_2014_Buchungskonto_4736946773(2).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\RechnungOnline_Monat_September_2014_Buchungskonto_4736946773.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Re_AW_Treffen_in_Bonn.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Re_hui.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Re_STRATO_AG_-_Ihr_Supportauftrag_vom_07_11_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\R_351_Stolberg-Donnerberg_-_Bewertung_am_11_10_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\STRATO_AG_K_ndigungsbest_tigung_zu_Ihrer_Kundennummer_63092954.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Unterlagen_zur_Erstellung_von_BB_und_LZB(1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Unterlagen_zur_Erstellung_von_BB_und_LZB.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Vielen_Dank_f_r_die_Geschenke_-.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Vielen_Dank_f_r_Ihre_Bestellung_vom_15_Oktober_2014.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\WDR_Abenteuerreise_-_Einladu_ng_f_r_Mittwoch_10_12_2014_um_10.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\WG_F_rderplan.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Zisch_Neues_Informationsmaterial_f_r_Sie_und_Ihre_Sch_ler.eml:OECustomProperty
AlternateDataStreams: C:\Users\Ingrid\Downloads\Zusendung_Ihrer_Geb_hrenfrei_MasterCard_Gold.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "PSUAMain"

========================= Accounts: ==========================

Administrator (S-1-5-21-2085259247-1724912421-3600129739-500 - Administrator - Disabled)
Gast (S-1-5-21-2085259247-1724912421-3600129739-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2085259247-1724912421-3600129739-1005 - Limited - Enabled)
Ingrid (S-1-5-21-2085259247-1724912421-3600129739-1001 - Administrator - Enabled) => C:\Users\Ingrid

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/23/2014 08:46:53 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.3.9600.16384, Zeitstempel: 0x5215dfc6
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebd22
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000039a7a
ID des fehlerhaften Prozesses: 0x13d0
Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0
Pfad der fehlerhaften Anwendung: DllHost.exe1
Pfad des fehlerhaften Moduls: DllHost.exe2
Berichtskennung: DllHost.exe3
Vollständiger Name des fehlerhaften Pakets: DllHost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: DllHost.exe5

Error: (12/23/2014 08:38:40 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (12/23/2014 08:38:38 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (12/23/2014 08:38:33 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (12/23/2014 08:38:33 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (12/23/2014 08:38:25 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (12/23/2014 08:38:25 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (12/22/2014 11:21:41 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (12/22/2014 11:21:15 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (12/22/2014 11:15:45 PM) (Source: Windows Search Service) (EventID: 3079) (User: )
Description: Benachrichtigungen für Volume C:\ sind nicht aktiv. 

Kontext: Windows Anwendung


Details:
	Nicht genügend Quoten, um den angeforderten Dienst auszuführen.  (HRESULT : 0x800705ad) (0x800705ad)


System errors:
=============
Error: (12/23/2014 08:31:44 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/23/2014 08:31:00 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎22.‎12.‎2014 um 23:14:21 unerwartet heruntergefahren.

Error: (12/23/2014 08:30:20 AM) (Source: Microsoft-Windows-HAL) (EventID: 13) (User: NT-AUTORITÄT)
Description: Der Systemüberwachungszeitgeber wurde ausgelöst.

Error: (12/22/2014 07:15:12 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:12 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:11 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:11 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:11 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:10 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (12/22/2014 07:15:10 PM) (Source: DCOM) (EventID: 10016) (User: VAI)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}VAIIngridS-1-5-21-2085259247-1724912421-3600129739-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar


Microsoft Office Sessions:
=========================
Error: (12/23/2014 08:46:53 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: DllHost.exe6.3.9600.163845215dfc6ntdll.dll6.3.9600.1727853eebd22c00000050000000000039a7a13d001d01e849a1260deC:\WINDOWS\system32\DllHost.exeC:\WINDOWS\SYSTEM32\ntdll.dlldbcbb962-8a77-11e4-bec7-b8763fb46214

Error: (12/23/2014 08:38:40 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Ingrid\Downloads\esetsmartinstaller_deu.exe

Error: (12/23/2014 08:38:38 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Ingrid\Downloads\esetsmartinstaller_deu.exe

Error: (12/23/2014 08:38:33 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Ingrid\Downloads\esetsmartinstaller_deu.exe

Error: (12/23/2014 08:38:33 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Ingrid\Downloads\esetsmartinstaller_deu.exe

Error: (12/23/2014 08:38:25 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Ingrid\Downloads\esetsmartinstaller_enu.exe

Error: (12/23/2014 08:38:25 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Ingrid\Downloads\esetsmartinstaller_deu.exe

Error: (12/22/2014 11:21:41 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: C:\WINDOWS\system32\taskhost.exeC:\WINDOWS\system32\taskhost.exe0

Error: (12/22/2014 11:21:15 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: C:\WINDOWS\system32\srtasks.exeC:\WINDOWS\system32\srtasks.exe0

Error: (12/22/2014 11:15:45 PM) (Source: Windows Search Service) (EventID: 3079) (User: )
Description: Kontext: Windows Anwendung


Details:
	Nicht genügend Quoten, um den angeforderten Dienst auszuführen.  (HRESULT : 0x800705ad) (0x800705ad)
C:\


CodeIntegrity Errors:
===================================
  Date: 2014-10-05 13:43:02.207
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe that did not meet the Store signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU 987 @ 1.50GHz
Percentage of memory in use: 46%
Total physical RAM: 3972.8 MB
Available physical RAM: 2131.39 MB
Total Pagefile: 8068.8 MB
Available Pagefile: 5615.73 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:438.39 GB) (Free:363.11 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 39EC5E17)

Partition: GPT Partition Type.

==================== End Of Log ============================
         
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.93  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Panda Internet Security 2015   
Avira Desktop                  
Windows Defender               
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 71  
 Adobe Flash Player 	16.0.0.235  
 Adobe Reader XI  
 Mozilla Firefox (34.0.5) 
 Google Chrome (39.0.2171.71) 
 Google Chrome (39.0.2171.95) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         
Ich habe noch einen Panda-Antivirus-Programm entdeckt, was -laut meiner Mutter- plötzlich da war...

Liebe Grüße,
Katharina
__________________

Alt 24.12.2014, 13:36   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



Zitat:
Ich habe noch einen Panda-Antivirus-Programm entdeckt, was -laut meiner Mutter- plötzlich da war...
Wie plötzlich da war? Wo?

Macht der Rechner noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.12.2014, 13:45   #5
kaethe_
 
Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



Also "Plötzlich da" bedeutet, dass dieses Programm auf dem Rechner drauf war - ohne das meine Mutter dieses wissentlich installiert hatte. Ich vermute, sie hatte es ohne es zu merken, drauf installiert.
Nein, sonst macht der PC keine Probleme.


Alt 25.12.2014, 11:38   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



Ja die volle Security von Panda ist installiert, dann kannste Avira deinstallieren.

Download Ordner leeren.


Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
--> Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,

Alt 26.12.2014, 16:30   #7
kaethe_
 
Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



Vielen Dank für deine Hilfe! :-) Ich habe keine Fragen mehr :-)

Alt 27.12.2014, 06:51   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Standard

Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,
antivir, antivirus, auftrag, avira, browser, canon, desktop, device driver, failed, firefox, flash player, google, helper, home, hängen, iexplore.exe, internet explorer, livecomm.exe, malware, mozilla, onlineshop, programm, psuamain.exe, realtek, registry, scan, security, software, super, svchost.exe, werbung, windows, windowsapps, xperia



Ähnliche Themen: Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,


  1. FPS dropps - Windows 8.1 Maleware / Addware gefunden ADWcleaner
    Plagegeister aller Art und deren Bekämpfung - 23.07.2015 (11)
  2. Windows 7: Adwcleaner stürzt ab
    Log-Analyse und Auswertung - 10.06.2015 (7)
  3. Buzzdock Virus, Windows 7: MBAM, AdwCleaner, JRT, ESET bereits laufen lassen
    Log-Analyse und Auswertung - 11.02.2015 (17)
  4. Windows 7: AVAST 3 Funde, Malwarebytes 8 Funde
    Log-Analyse und Auswertung - 16.12.2014 (13)
  5. AdwCleaner-Log: Können Funde in Registrierungsdatenbank gelöscht werden?
    Log-Analyse und Auswertung - 20.09.2014 (3)
  6. Windows 7: 30 Funde mbam, 2 Funde avira
    Log-Analyse und Auswertung - 30.08.2014 (12)
  7. AdwCleaner vs. APPL/Downloader.Gen = alles ok! Aber wie werde ich nun AdwCleaner 3.212 wieder los?
    Plagegeister aller Art und deren Bekämpfung - 14.06.2014 (5)
  8. Funde von AdwCleaner
    Log-Analyse und Auswertung - 27.04.2014 (4)
  9. Windows 7: Wiederholte Funde bösartiger Software durch MBAM
    Log-Analyse und Auswertung - 09.02.2014 (7)
  10. nach Nutzung von AdwCleaner: Verlust von Windows XP Benutzerprofil
    Plagegeister aller Art und deren Bekämpfung - 05.01.2014 (4)
  11. Was bedeutet: hklm/software/description - gefunden von AdwCleaner
    Plagegeister aller Art und deren Bekämpfung - 31.12.2013 (7)
  12. Funde durch AdwCleaner...weitere Schritte nötig?
    Plagegeister aller Art und deren Bekämpfung - 24.11.2013 (3)
  13. Windows 7: Avira hat 172 Viren gefunden, davor mehrer Funde einzel Funde bei Malwarebytes bzw. Avira
    Log-Analyse und Auswertung - 15.09.2013 (13)
  14. mit adwcleaner malware entfernt - Windows 7 bootet nicht mehr
    Plagegeister aller Art und deren Bekämpfung - 21.08.2013 (17)
  15. Laptop plötzlich total langsam..Funde durch adwCleaner
    Plagegeister aller Art und deren Bekämpfung - 27.07.2013 (9)
  16. Delta Search mit AdwCleaner entfernt? (Windows 8)
    Plagegeister aller Art und deren Bekämpfung - 28.03.2013 (15)
  17. AntiVir meldet Funde, T-Online Software verhält sich merkwürdig
    Plagegeister aller Art und deren Bekämpfung - 27.06.2007 (3)

Zum Thema Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, - Liebes Trojaner-Board, dieses Mal melde ich mich bei euch, weil scheinbar der PC meiner Mutter mit dem Programm Super easy driver und eventuell noch weiteren Programmen befallen ist. Meine Mutter - Windows 8.1: Funde bei AdwCleaner: SuperEasy Software,...
Archiv
Du betrachtest: Windows 8.1: Funde bei AdwCleaner: SuperEasy Software, auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.