Hallo,
er braucht länger zum Hochfahren, Firefox braucht normal lang um eine Seite zu laden wenn die Seite vollständig da ist erscheint trotzdem das Rädchen neben dem Mauspfeil und es reagiert verzögert. Bei Antivira konnte ich kein Update mehr machen, auch nach Neuinstallation nicht. Die Menüleiste vom Firefox blinkt manchmal auf ohne ersichtlichen Grund.

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:05 on 22/07/2015 (Dana)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

[CODE]Additional
FRST Logfile:

scan result of Farbar Recovery Scan Tool (x64) Version:20-07-2015
Ran by Dana at 2015-07-22 14:08:55
Running from C:\Users\Dana\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1602078527-2339295992-2746922436-500 - Administrator - Disabled)
Dana (S-1-5-21-1602078527-2339295992-2746922436-1001 - Administrator - Enabled) => C:\Users\Dana
Gast (S-1-5-21-1602078527-2339295992-2746922436-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Spybot - Search and Destroy (Enabled - Up to date) {20A26C15-1AF0-7CA3-9380-FAB824A7EE0D}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.144 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Amazon Music (HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Amazon Amazon Music) (Version: 3.10.0.924 - Amazon Services LLC)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.3.2223 - AVAST Software)
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.28.50 - Conexant)
CyberLink MediaStory (HKLM-x32\...\InstallShield_{55762F9A-FCE3-45d5-817B-051218658423}) (Version: 1.0.1314 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dependency Package Update (Version: 1.6.25.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.36.00 - Lenovo Inc.) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Dropbox) (Version: 3.6.8 - Dropbox, Inc.)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.35 - Lenovo)
Energy Manager (x32 Version: 1.0.0.35 - Lenovo) Hidden
Google Talk Plugin (HKLM-x32\...\{CA3DD97D-1FD7-37A7-BD5C-FC4430C8B8E6}) (Version: 5.41.2.0 - Google)
Hightail for Lenovo (HKLM\...\{2F10E937-F6D7-4174-8AB9-B299E8FC5CEC}) (Version: 2.4.97.2857 - Hightail, Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3379 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.0.0.1098 - Intel Corporation)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.25.00 - Lenovo Group Limited)
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10264 - Realtek Semiconductor Corp.)
Lenovo FusionEngine  (HKLM-x32\...\Lenovo FusionEngine) (Version: 1.0.13.0 - Lenovo, Inc.)
Lenovo Mobile Phone Wireless Import (HKLM-x32\...\InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}) (Version: 1.1.1.9 - Lenovo)
Lenovo Mobile Phone Wireless Import (x32 Version: 1.1.1.9 - Lenovo) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo Photo Master (HKLM-x32\...\InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 1.0.1823.01 - CyberLink Corp.)
Lenovo Photo Master (x32 Version: 1.0.1823.01 - CyberLink Corp.) Hidden
Lenovo pointing device (HKLM\...\Elantech) (Version: 11.4.31.1 - ELAN Microelectronic Corp.)
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
Lenovo SHAREit (HKLM-x32\...\Lenovo SHAREit_is1) (Version: 2.0.5.0 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{1CA74803-5CB2-4C03-BDBE-061EDC81CC7F}) (Version: 2.8.004.00 - Lenovo Group Limited)
Lenovo VeriFace (HKLM\...\Lenovo VeriFace) (Version: 5.0.13.5261 - Lenovo)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.810.810.032714 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0238 - REALTEK Semiconductor Corp.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.14123.5 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.14123.5 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Spotify (HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Spotify) (Version: 1.0.9.133.gcedaee38 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1602078527-2339295992-2746922436-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)

==================== Restore Points =========================

06-07-2015 11:57:45 Geplanter Prüfpunkt
09-07-2015 16:41:17 Windows Update
15-07-2015 22:43:48 Windows Update
19-07-2015 08:45:33 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1C5276C6-BC3E-473B-8C49-0C96A5CB9591} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-03-09] ()
Task: {3A8B4728-3A3A-45FB-BBF8-4A677606A771} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core => C:\Users\Dana\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-16] (Dropbox, Inc.)
Task: {3FF30DE1-5D28-48F2-9074-EC88E2AF1C83} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-07-19] (AVAST Software)
Task: {45CF86E0-90E3-4D80-BEAF-8429911205AD} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {45EE4F65-9AE3-484A-890D-2FF5A1B29026} - System32\Tasks\OFFICE2013ACT => C:\ProgramData\Office2013\OFFICEICON.vbs [2013-06-03] ()
Task: {603B809C-86C2-42F4-B412-E29291AA74E0} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2015-03-09] (Lenovo)
Task: {66F5275A-B505-4684-B7B8-605D2A4E864F} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {66F7E18C-EC71-45CD-B37C-1F0ABF86DCD8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {811675C7-DFFA-4C12-9BFE-461681F2D0B3} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core => C:\Users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-28] (Google Inc.)
Task: {86282C69-8B63-438F-BBD5-5CA34CD10488} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-03-09] (Lenovo)
Task: {A0CC9125-50D9-4BE6-8EE5-808A0FE8133E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA => C:\Users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe [2015-03-28] (Google Inc.)
Task: {A8A03538-475D-47D0-9587-9484B500059F} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2014-05-21] ()
Task: {A962D4DE-86E6-4D14-A228-0E3019C12EBF} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {AC9CD0B8-267D-46D3-80C2-4A3B20F469E2} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {AF3E0028-2B5A-4565-9FFC-09071BA4EBD4} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2015-03-09] (Lenovo)
Task: {B1B9B670-A301-4B8E-B879-37B368398514} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2015-03-09] ()
Task: {C4D67B3F-3B16-4F79-BD88-427635710AE1} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {D64717D1-270A-44E0-BAFC-000F7CED975B} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D8C2DB6E-96BC-4E13-B0A3-ED5E0181FDDA} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA => C:\Users\Dana\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-16] (Dropbox, Inc.)
Task: {EAB32924-B26B-4C31-BF6F-1BA6FC5A1A31} - System32\Tasks\{20368B89-5704-4AA7-B4E3-8942B0189AD1} => pcalua.exe -a C:\Users\Dana\AppData\Roaming\webssearches\UninstallManager.exe -c  -ptid=cvs <==== ATTENTION
Task: {FFF7C793-BCA7-4B5B-8095-0072F0887D14} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-14] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job => C:\Users\Dana\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job => C:\Users\Dana\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job => C:\Users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job => C:\Users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2014-09-27 06:47 - 2014-03-27 15:12 - 00095232 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-09-27 07:30 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-09-27 07:34 - 2014-09-27 07:34 - 00068368 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
2014-09-27 07:34 - 2014-09-27 07:34 - 00669288 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfDataStorageInterface.dll
2014-09-27 06:44 - 2010-10-26 06:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2015-01-16 15:50 - 2015-07-17 08:33 - 05887808 _____ () C:\Users\Dana\AppData\Local\Amazon Music\Amazon Music Helper.exe
2015-01-12 13:12 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-12 13:12 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-12 13:12 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-12 13:12 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-12 13:12 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-09-27 06:42 - 2013-09-16 21:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-07-19 09:35 - 2015-07-19 09:35 - 00102864 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-07-19 09:35 - 2015-07-19 09:35 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-07-19 09:36 - 2015-07-19 09:36 - 02956800 _____ () C:\Program Files\AVAST Software\Avast\defs\15071804\algo.dll
2015-07-21 13:15 - 2015-07-21 13:15 - 02957312 _____ () C:\Program Files\AVAST Software\Avast\defs\15072100\algo.dll
2015-07-22 13:32 - 2015-07-22 13:32 - 00043008 _____ () c:\users\dana\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp27hanx.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00750080 _____ () C:\Users\Dana\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00047616 _____ () C:\Users\Dana\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00865280 _____ () C:\Users\Dana\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00200704 _____ () C:\Users\Dana\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\Dana\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00726016 _____ () C:\Users\Dana\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-03-04 23:45 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\Dana\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-07-19 09:35 - 2015-07-19 09:35 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Dana\Documents\3Plusss - weniger EP.mp3:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VisualDiscovery => ""="service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Dana\Documents\My Bluetooth\Hanne.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{C7E89BA0-B94A-4991-90AB-B318B5015BD3}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{2E80CA9A-1E89-4970-9906-7358A16D0838}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{987BE64F-F21B-40BF-947C-37E223906708}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{62BC4E7A-B5DF-417F-8AB4-5808ADBE1DAF}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{314473C7-5085-4471-BA1D-D4E7E822EF24}] => (Allow) C:\Program Files (x86)\Lenovo\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{381BCDF8-E7B8-4F35-B216-477FA6FCE99A}] => (Allow) C:\Program Files (x86)\Lenovo\Lenovo Photo Master\PhotoPlus.exe
FirewallRules: [{5742CE08-9048-4215-911E-1042817EBFB5}] => (Allow) C:\Program Files (x86)\Lenovo\Lenovo Photo Master\subsys\AdvPhotoEditor\PhotoDirector5.exe
FirewallRules: [{E1C261AF-CEB3-474D-9B04-59E5ABC12D05}] => (Allow) LPort=55100
FirewallRules: [{B11C1827-3EE9-45D6-AFE0-B9CE03BD0DE4}] => (Allow) C:\Program Files\Lenovo PhotoMasterImport\PhotoMasterImport.exe
FirewallRules: [{C8E994E0-047A-4EB1-BB15-603E03CCCF9F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C5757156-49FD-42CA-8498-CD8FB742E16A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5C191F5B-1999-4AEC-966D-AAB621C158AC}C:\users\dana\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dana\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{8F2C54D2-64D6-4F80-8A35-0B1CCDC30230}C:\users\dana\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dana\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{54FA124C-72F4-43DA-AE26-B7B79E1CBC98}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{7649C10C-C689-4F40-8065-98F855E8F3DD}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{D2C4AB05-F162-4204-A8F6-6D3FF6461073}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B46014FC-EDFF-4CD3-B691-CDF7082E157F}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F562397A-B346-4823-A601-D9874444FD20}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{82EF60C7-5227-4512-8392-88BFC4068E56}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{B947DDA9-8B59-4F90-81EB-C3034E2D085F}] => (Allow) C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{DFA09E04-698A-4129-8C1E-5040967DDBCC}] => (Allow) C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/22/2015 02:09:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2dba8
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e394
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e080
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e2e8
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e200
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2dba8
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e048
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e0ac
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e2f0
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5

Error: (07/22/2015 02:09:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mpcmdrun.exe, Version: 4.7.205.0, Zeitstempel: 0x54cb5af5
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f4336
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec180
ID des fehlerhaften Prozesses: 0x2e2a8
Startzeit der fehlerhaften Anwendung: 0xmpcmdrun.exe0
Pfad der fehlerhaften Anwendung: mpcmdrun.exe1
Pfad des fehlerhaften Moduls: mpcmdrun.exe2
Berichtskennung: mpcmdrun.exe3
Vollständiger Name des fehlerhaften Pakets: mpcmdrun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mpcmdrun.exe5


System errors:
=============
Error: (07/20/2015 02:36:02 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (07/20/2015 02:35:29 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (07/19/2015 08:39:54 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (07/19/2015 08:39:21 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (07/19/2015 06:34:08 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (07/19/2015 06:33:35 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (07/19/2015 03:14:11 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (07/19/2015 03:13:39 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (07/19/2015 02:30:04 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (07/19/2015 02:29:30 PM) (Source: DCOM) (EventID: 10010) (User: lenovo-d)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}


Microsoft Office:
=========================
Error: (07/22/2015 02:09:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802dba801d0c477545bcf14C:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll9229bc3a-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e39401d0c47751e4f361C:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll8fb542c7-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e08001d0c4775005b91bC:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll8dd3a71e-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e2e801d0c4774e15ce4bC:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll8be87ff1-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e20001d0c4774c25e3a0C:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll89fd59f3-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802dba801d0c47749c84c76C:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll8793d6c5-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e04801d0c47747e1eae8C:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll85afd80e-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e0ac01d0c47745fe8a08C:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll83ced944-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e2f001d0c47744110194C:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll81deef97-306a-11e5-8280-1008b1a17200

Error: (07/22/2015 02:09:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mpcmdrun.exe4.7.205.054cb5af5KERNELBASE.dll6.3.9600.17736550f4336c000014200000000000ec1802e2a801d0c4774219efccC:\Program Files\Windows Defender\mpcmdrun.exeKERNELBASE.dll7ff3c86f-306a-11e5-8280-1008b1a17200


CodeIntegrity Errors:
===================================
  Date: 2015-07-22 13:37:57.625
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-22 08:59:35.438
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-22 08:47:13.304
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-22 08:36:26.803
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-21 14:10:24.380
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-21 13:26:41.396
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-21 11:58:06.769
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-21 11:10:21.845
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-20 14:35:22.470
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-20 14:23:56.869
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-4030U CPU @ 1.90GHz
Percentage of memory in use: 62%
Total physical RAM: 3988.27 MB
Available physical RAM: 1507.81 MB
Total Virtual: 4692.27 MB
Available Virtual: 1684.98 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:423.54 GB) (Free:371.97 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.08 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: AE0E0346)

Partition: GPT Partition Type.

==================== End of log ============================
         

--- --- ---

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Dana (administrator) on LENOVO-D on 22-07-2015 14:06:49
Running from C:\Users\Dana\Downloads
Loaded Profiles: Dana (Available Profiles: Dana)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
() C:\Users\Dana\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Spotify Ltd) C:\Users\Dana\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Dropbox, Inc.) C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files\lenovo\Lenovo Solution Center\LSCNotify.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-02-26] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2891080 2013-10-17] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216576 2014-03-10] (Realtek Semiconductor Corporation)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2014-02-27] (Realtek semiconductor)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-09-27] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-09-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-07-19] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1565504 2015-02-24] (Samsung)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Amazon Music] => C:\Users\Dana\AppData\Local\Amazon Music\Amazon Music Helper.exe [5887808 2015-07-17] ()
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Spotify Web Helper] => C:\Users\Dana\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2008632 2015-07-14] (Spotify Ltd)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Google Update] => C:\Users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-03-28] (Google Inc.)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Dropbox Update] => C:\Users\Dana\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
Startup: C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-05-03]
ShortcutTarget: Dropbox.lnk -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-07-19] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:57800;https=127.0.0.1:57800
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://lenovo13.msn.com/?pc=LCJB
hxxp://www.lenovo.com
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-07-19] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-19] (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{09E75A22-3EE0-4CEC-BDCD-5D51898E5AC0}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2A6509CE-CD0E-4DC3-A963-53BBA333FDAE}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\r687zc0f.default-1421086628845
FF NewTab: www.google.com
FF SelectedSearchEngine: Yahoo!
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Dana\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @talk.google.com/O1DPlugin -> C:\Users\Dana\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Dana\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Dana\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-07-19]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-19]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-07-19] (AVAST Software)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [95232 2014-03-27] () [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [99632 2013-10-09] (ELAN Microelectronics Corp.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-02-26] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-09-27] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272440 2015-03-09] (Lenovo)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-09-27] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-07-19] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-07-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-07-19] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-07-19] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1048856 2015-07-19] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447944 2015-07-19] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150160 2015-07-19] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-07-19] (AVAST Software)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [559832 2014-02-26] (Realtek Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [9109720 2014-02-27] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2982104 2013-12-26] (Realtek Semiconductor Corporation                           )
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-22 14:06 - 2015-07-22 14:07 - 00020726 _____ C:\Users\Dana\Downloads\FRST.txt
2015-07-22 14:06 - 2015-07-22 14:06 - 02135552 _____ (Farbar) C:\Users\Dana\Downloads\FRST64.exe
2015-07-22 14:05 - 2015-07-22 14:05 - 00000470 _____ C:\Users\Dana\Desktop\defogger_disable.log
2015-07-22 14:04 - 2015-07-22 14:04 - 00050477 _____ C:\Users\Dana\Downloads\Defogger.exe
2015-07-22 08:49 - 2015-07-22 14:06 - 00000000 ____D C:\FRST
2015-07-22 08:37 - 2015-07-22 08:37 - 00000000 _____ C:\Users\Dana\defogger_reenable
2015-07-20 09:48 - 2015-07-20 09:49 - 92110026 _____ C:\Users\Dana\Downloads\xvideos.com_410297d19300ebf948c379f87621ed60.mp4
2015-07-19 21:21 - 2015-07-22 08:55 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\thriXXX
2015-07-19 21:21 - 2015-07-19 21:25 - 00000000 ____D C:\Users\Dana\AppData\Roaming\thriXXX
2015-07-19 21:21 - 2015-07-19 21:21 - 00000000 ____D C:\ProgramData\thriXXX
2015-07-19 21:21 - 2015-07-19 21:21 - 00000000 ____D C:\Program Files (x86)\thriXXX
2015-07-19 13:25 - 2015-07-20 10:04 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-07-19 13:24 - 2015-07-19 13:24 - 00001129 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-19 13:24 - 2015-07-19 13:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-19 13:24 - 2015-07-19 13:24 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-19 13:24 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-07-19 13:24 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-07-19 13:24 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-07-19 13:23 - 2015-07-19 13:23 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Dana\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-19 09:39 - 2015-07-19 09:39 - 00000000 ____D C:\Users\Dana\AppData\Roaming\AVAST Software
2015-07-19 09:37 - 2015-07-19 09:37 - 00001949 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-07-19 09:37 - 2015-07-19 09:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-19 09:36 - 2015-07-19 09:36 - 00003924 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-07-19 09:36 - 2015-07-19 09:35 - 01048856 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00447944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00378880 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-07-19 09:36 - 2015-07-19 09:35 - 00274808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00150160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00093528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00090968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00065224 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00028656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-07-19 09:35 - 2015-07-19 09:35 - 00043112 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-07-19 09:34 - 2015-07-19 09:34 - 00000000 ____D C:\Program Files\AVAST Software
2015-07-19 09:32 - 2015-07-19 09:32 - 00000000 ____D C:\ProgramData\AVAST Software
2015-07-18 08:13 - 2015-06-30 00:43 - 00026288 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-07-18 08:13 - 2015-06-29 17:07 - 01145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-07-18 08:13 - 2015-06-27 01:21 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-07-18 08:13 - 2015-06-27 01:21 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-07-16 10:07 - 2015-05-11 18:34 - 00332800 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll
2015-07-16 10:07 - 2015-05-03 17:07 - 07784448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2015-07-16 10:07 - 2015-05-03 16:57 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2015-07-16 10:07 - 2015-05-02 01:33 - 00410739 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-07-16 10:07 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\SysWOW64\locale.nls
2015-07-16 10:07 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\system32\locale.nls
2015-07-16 10:07 - 2015-04-23 17:47 - 03084288 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-07-16 10:07 - 2015-04-23 17:16 - 02471424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-07-15 11:02 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2015-07-15 11:02 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-07-15 11:02 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2015-07-15 11:02 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2015-07-15 11:02 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2015-07-15 11:02 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2015-07-15 11:02 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2015-07-15 11:02 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2015-07-15 11:02 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-07-15 11:02 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-07-15 11:02 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-07-15 11:02 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-07-15 11:02 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-07-15 11:02 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-07-15 11:02 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2015-07-15 11:02 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2015-07-15 11:02 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2015-07-15 11:02 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2015-07-15 11:02 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-07-15 11:02 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-07-15 11:01 - 2015-07-09 21:51 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-07-15 11:01 - 2015-07-09 20:40 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-07-15 11:01 - 2015-07-09 18:03 - 03701760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-07-15 11:01 - 2015-07-09 17:54 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-07-15 11:01 - 2015-07-09 17:53 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-07-15 11:01 - 2015-07-09 17:50 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-07-15 11:01 - 2015-07-09 17:50 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-07-15 11:01 - 2015-07-09 17:48 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-07-15 11:01 - 2015-07-09 17:46 - 02229248 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-07-15 11:01 - 2015-07-09 17:38 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-07-15 11:01 - 2015-07-09 17:37 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-07-15 11:01 - 2015-07-09 17:35 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-07-15 11:01 - 2015-07-09 17:34 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-07-15 11:01 - 2015-07-03 15:52 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-07-15 11:01 - 2015-07-03 15:52 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-07-15 11:01 - 2015-07-03 15:50 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-07-15 11:01 - 2015-07-03 15:50 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-07-15 11:01 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-07-15 11:01 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-07-15 11:01 - 2015-06-27 05:08 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-07-15 11:01 - 2015-06-27 05:08 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-07-15 11:01 - 2015-06-27 04:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-07-15 11:01 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-07-15 11:01 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-07-15 11:01 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-07-15 11:00 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-07-15 11:00 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-07-15 10:59 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-07-15 10:59 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-07-15 10:59 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-07-15 10:59 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-07-15 10:59 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-07-15 10:59 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-07-15 10:59 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-07-15 10:59 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-07-15 10:59 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-07-15 10:59 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-07-15 10:59 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2015-07-15 10:59 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2015-07-15 10:59 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-07-15 10:59 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-07-15 10:59 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-07-15 10:59 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-07-15 10:59 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-07-15 10:59 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-07-15 10:59 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-07-15 10:59 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-07-15 10:59 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-07-15 10:59 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-07-15 10:59 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-07-15 10:59 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-07-15 10:59 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-07-15 10:59 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-07-15 10:59 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2015-07-15 10:59 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2015-07-15 10:59 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-07-15 10:59 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-07-15 10:59 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-07-15 10:59 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-07-15 10:59 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-07-15 10:59 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-07-15 10:59 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-07-15 10:59 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-07-15 10:59 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-07-15 10:59 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-07-15 10:59 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-07-15 10:58 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2015-07-15 10:58 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2015-07-15 10:58 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-07-15 10:58 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-07-15 10:58 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll
2015-07-14 19:42 - 2015-07-14 19:42 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Dana\Downloads\spybot2-license.exe
2015-07-09 17:20 - 2015-07-09 17:20 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-07 16:04 - 2015-07-07 20:40 - 00012465 _____ C:\Users\Dana\Documents\Fragen Paket.de.odt
2015-07-07 12:21 - 2015-07-09 12:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-27 06:49 - 2015-06-27 06:50 - 89039562 _____ C:\Users\Dana\Downloads\Welcome.zip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-22 14:02 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-07-22 13:52 - 2015-01-14 13:22 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-07-22 13:44 - 2014-09-27 06:08 - 01269947 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-22 13:43 - 2013-08-22 16:46 - 00083219 _____ C:\WINDOWS\setupact.log
2015-07-22 13:36 - 2015-01-03 20:31 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1602078527-2339295992-2746922436-1001
2015-07-22 13:33 - 2015-05-03 10:30 - 00000000 ___RD C:\Users\Dana\Dropbox
2015-07-22 13:33 - 2015-05-03 10:27 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Dropbox
2015-07-22 13:32 - 2015-03-28 17:15 - 00001134 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job
2015-07-22 13:31 - 2015-01-03 20:24 - 00723228 _____ C:\Users\Dana\AppData\Local\BTServer.log
2015-07-22 09:07 - 2014-09-27 06:44 - 04047792 _____ C:\Users\Public\CAFADEBUG.log
2015-07-22 08:37 - 2015-01-03 20:23 - 00000000 ____D C:\Users\Dana
2015-07-22 08:25 - 2015-01-03 21:59 - 00003926 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{91E03A35-91AC-4E7C-8AC3-167C4C714877}
2015-07-22 08:24 - 2015-06-16 08:13 - 00001238 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job
2015-07-21 11:06 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-07-19 20:50 - 2015-03-06 14:09 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Nitro PDF
2015-07-19 16:18 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-07-19 14:41 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-07-19 14:37 - 2015-01-13 22:37 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-07-19 14:37 - 2015-01-13 22:37 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-07-19 14:36 - 2015-01-12 23:18 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-07-19 09:40 - 2015-01-12 19:16 - 00000000 ____D C:\ProgramData\Avira
2015-07-19 09:40 - 2014-09-27 06:48 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-19 09:39 - 2015-01-03 20:25 - 00000000 ____D C:\Users\Dana\AppData\Local\VirtualStore
2015-07-19 09:23 - 2015-06-16 08:13 - 00001186 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job
2015-07-19 09:22 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-07-19 09:21 - 2014-09-27 07:34 - 00006656 _____ C:\WINDOWS\system32\VfService.trf
2015-07-19 09:21 - 2014-03-18 11:44 - 00461220 _____ C:\WINDOWS\PFRO.log
2015-07-19 09:18 - 2015-06-16 08:13 - 00004182 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA
2015-07-19 09:18 - 2015-06-16 08:13 - 00003802 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core
2015-07-19 08:50 - 2015-04-04 19:32 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-07-19 08:50 - 2015-04-04 19:32 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-07-19 08:50 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-07-18 22:58 - 2015-01-12 13:12 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-16 07:32 - 2015-03-28 17:15 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job
2015-07-16 07:27 - 2015-03-28 17:15 - 00004078 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA
2015-07-16 07:27 - 2015-03-28 17:15 - 00003698 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core
2015-07-16 07:19 - 2013-08-22 16:44 - 00377296 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-07-15 23:04 - 2015-02-23 17:47 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Spotify
2015-07-15 22:45 - 2015-02-23 17:48 - 00000000 ____D C:\Users\Dana\AppData\Local\Spotify
2015-07-14 20:47 - 2015-01-03 20:29 - 00000000 ____D C:\Users\Dana\AppData\Local\Adobe
2015-07-14 20:45 - 2015-01-14 13:22 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-07-14 19:44 - 2015-01-12 13:12 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 23:10 - 2015-01-14 12:55 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2015-01-14 12:55 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-10 16:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-07-09 18:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-07-09 13:54 - 2015-02-04 09:58 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieBrowserModeList
2015-07-09 13:54 - 2015-01-12 13:03 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieUserList
2015-07-09 13:54 - 2015-01-12 13:03 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieSiteList
2015-07-09 12:41 - 2015-01-12 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-09 12:40 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-07-09 12:38 - 2015-01-12 19:55 - 00000000 ____D C:\AdwCleaner
2015-07-07 13:20 - 2015-01-16 15:50 - 00001142 _____ C:\Users\Dana\Desktop\Amazon Music.lnk
2015-07-03 08:43 - 2015-01-12 23:18 - 130333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2015-01-03 20:24 - 2015-07-22 13:31 - 0723228 _____ () C:\Users\Dana\AppData\Local\BTServer.log
2014-09-27 06:44 - 2014-09-27 06:44 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Dana\AppData\Local\Temp\avgnt.exe
C:\Users\Dana\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp27hanx.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-20 14:35

==================== End of log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-07-22 14:28:50
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002c ST500LT012-1DG142 rev.0002LVM1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Dana\AppData\Local\Temp\fxldapog.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\WINDOWS\System32\win32k.sys!W32pServiceTable                                                                                                                                                                                                           fffff96000235600 15 bytes [00, 96, F2, 01, 00, 6A, 6C, ...]
.text    C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16                                                                                                                                                                                                      fffff96000235610 11 bytes [00, D7, FB, FF, 00, 7B, D1, ...]

---- User code sections - GMER 2.1 ----

.text    C:\WINDOWS\system32\wininit.exe[516] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\wininit.exe[516] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                      00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\wininit.exe[516] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                      00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\wininit.exe[516] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                              00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\wininit.exe[516] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                             00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\lsass.exe[640] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                  00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\lsass.exe[640] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                        00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\lsass.exe[640] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                        00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\lsass.exe[640] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                                00007ffc22618e46 3 bytes [C4, 71, 2F]
.text    C:\WINDOWS\system32\svchost.exe[712] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\svchost.exe[712] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                      00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\svchost.exe[712] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                      00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\svchost.exe[712] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                              00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\svchost.exe[712] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                             00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\System32\svchost.exe[868] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                             00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\svchost.exe[896] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x1c5c390]}
.text    C:\WINDOWS\system32\svchost.exe[896] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                      00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x1c1b580]}
.text    C:\WINDOWS\system32\svchost.exe[896] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                      00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x1c38500]}
.text    C:\WINDOWS\system32\svchost.exe[896] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                              00007ffc22618e46 3 bytes [C4, 71, 2F]
.text    C:\WINDOWS\system32\svchost.exe[896] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                             00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\System32\svchost.exe[308] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x1c5c390]}
.text    C:\WINDOWS\System32\svchost.exe[308] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                      00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x1c1b580]}
.text    C:\WINDOWS\System32\svchost.exe[308] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                      00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x1c38500]}
.text    C:\WINDOWS\System32\svchost.exe[308] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                              00007ffc22618e46 3 bytes [C4, 71, 2F]
.text    C:\WINDOWS\System32\svchost.exe[308] C:\WINDOWS\SYSTEM32\advapi32.dll!CreateProcessWithLogonW                                                                                                                                                             00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\svchost.exe[644] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                              00007ffc22618e46 3 bytes [C4, 71, 2F]
.text    C:\WINDOWS\system32\svchost.exe[1188] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                               00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\WINDOWS\system32\svchost.exe[1188] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                     00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\WINDOWS\system32\svchost.exe[1188] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                     00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\WINDOWS\system32\svchost.exe[1188] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                             00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\svchost.exe[1188] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                            00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\System32\svchost.exe[1452] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                             00007ffc22618e46 3 bytes [C4, 71, 2F]
.text    C:\WINDOWS\System32\svchost.exe[1452] C:\WINDOWS\SYSTEM32\advapi32.dll!CreateProcessWithLogonW                                                                                                                                                            00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe[1752] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                          00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe[1752] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe[1752] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe[1752] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                        00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe[1752] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                       00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Windows\System32\WUDFHost.exe[2624] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                              00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\Windows\System32\WUDFHost.exe[2624] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                    00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Windows\System32\WUDFHost.exe[2624] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                    00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Windows\System32\WUDFHost.exe[2624] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                            00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Windows\System32\WUDFHost.exe[2624] C:\WINDOWS\SYSTEM32\advapi32.dll!CreateProcessWithLogonW                                                                                                                                                           00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\wbem\wmiprvse.exe[4552] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                         00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\wbem\wmiprvse.exe[4552] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                               00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\wbem\wmiprvse.exe[4552] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                               00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\wbem\wmiprvse.exe[4552] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                       00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\wbem\wmiprvse.exe[4552] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                      00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\taskhost.exe[166576] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                            00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\taskhost.exe[166576] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                  00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\taskhost.exe[166576] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                  00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\taskhost.exe[166576] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                          00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\taskhost.exe[166576] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                         00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\System32\dwm.exe[181980] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                 00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\System32\dwm.exe[181980] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                       00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\System32\dwm.exe[181980] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                       00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\System32\dwm.exe[181980] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                               00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\System32\dwm.exe[181980] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                              00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files\Elantech\ETDCtrl.exe[179808] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                       00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x1dbc390]}
.text    C:\Program Files\Elantech\ETDCtrl.exe[179808] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                             00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x1d7b580]}
.text    C:\Program Files\Elantech\ETDCtrl.exe[179808] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                             00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x1d98500]}
.text    C:\Program Files\Elantech\ETDCtrl.exe[179808] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                     00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files\Elantech\ETDCtrl.exe[179808] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                    00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\Explorer.EXE[181288] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                     00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\Explorer.EXE[181288] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                           00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\Explorer.EXE[181288] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                           00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\Explorer.EXE[181288] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                                   00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\Explorer.EXE[181288] C:\WINDOWS\SYSTEM32\advapi32.dll!CreateProcessWithLogonW                                                                                                                                                                  00007ffc24cbef80 6 bytes JMP ff513237
.text    C:\WINDOWS\system32\taskhostex.exe[181016] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                          00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\taskhostex.exe[181016] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\taskhostex.exe[181016] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\taskhostex.exe[181016] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                        00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\taskhostex.exe[181016] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                       00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\DllHost.exe[175792] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                             00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\DllHost.exe[175792] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                   00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\DllHost.exe[175792] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                   00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\DllHost.exe[175792] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                           00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\DllHost.exe[175792] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                          00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[175492] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                 00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[175492] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                       00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[175492] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                       00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[175492] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                               00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[175492] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                              00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files\Elantech\ETDIntelligent.exe[126588] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\Program Files\Elantech\ETDIntelligent.exe[126588] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                      00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Program Files\Elantech\ETDIntelligent.exe[126588] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                      00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Program Files\Elantech\ETDIntelligent.exe[126588] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                              00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files\Elantech\ETDIntelligent.exe[126588] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                             00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe[177292] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                               00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x1dbc390]}
.text    C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe[177292] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                     00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x1d7b580]}
.text    C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe[177292] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                     00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x1d98500]}
.text    C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe[177292] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                             00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe[177292] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                            00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Windows\System32\igfxtray.exe[180892] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                            00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\Windows\System32\igfxtray.exe[180892] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                  00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Windows\System32\igfxtray.exe[180892] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                  00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Windows\System32\igfxtray.exe[180892] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                          00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Windows\System32\igfxtray.exe[180892] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                         00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\igfxsrvc.exe[180540] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                            00007ffc22e83ca0 6 bytes JMP 43edf620
.text    C:\WINDOWS\system32\igfxsrvc.exe[180540] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                  00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\WINDOWS\system32\igfxsrvc.exe[180540] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                  00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\WINDOWS\system32\igfxsrvc.exe[180540] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                          00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\igfxsrvc.exe[180540] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                         00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Windows\System32\hkcmd.exe[180564] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                               00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\Windows\System32\hkcmd.exe[180564] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                     00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Windows\System32\hkcmd.exe[180564] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                     00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Windows\System32\hkcmd.exe[180564] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                             00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Windows\System32\hkcmd.exe[180564] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                            00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Windows\System32\igfxpers.exe[139512] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                            00007ffc22e83ca0 6 bytes JMP 43edf620
.text    C:\Windows\System32\igfxpers.exe[139512] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                  00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Windows\System32\igfxpers.exe[139512] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                  00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Windows\System32\igfxpers.exe[139512] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                          00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Windows\System32\igfxpers.exe[139512] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                         00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe[175600] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                         00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x73c390]}
.text    C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe[175600] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                               00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x6fb580]}
.text    C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe[175600] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                               00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x718500]}
.text    C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe[175600] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                       00007ffc22618e46 3 bytes CALL fb1
.text    C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe[175600] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                      00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[172656] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                             00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[172656] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                   00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[172656] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                   00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[172656] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                           00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[172656] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                          00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Windows\RTFTrack.exe[139664] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                                     00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x1dbc390]}
.text    C:\Windows\RTFTrack.exe[139664] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                                           00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x1d7b580]}
.text    C:\Windows\RTFTrack.exe[139664] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                                           00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x1d98500]}
.text    C:\Windows\RTFTrack.exe[139664] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                                   00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Windows\RTFTrack.exe[139664] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                                  00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe[173112] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                             00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x1dbc390]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe[173112] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                   00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x1d7b580]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe[173112] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                   00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x1d98500]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe[173112] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                           00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe[173112] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                          00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe[172664] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                    00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x55c390]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe[172664] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                          00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x51b580]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe[172664] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                          00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x538500]}
.text    C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe[172664] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                  00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe[172664] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                 00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}
.text    C:\WINDOWS\system32\wbem\unsecapp.exe[182812] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessAsUserW                                                                                                                                                       00007ffc22e83ca0 6 bytes {JMP QWORD [RIP+0x19c390]}
.text    C:\WINDOWS\system32\wbem\unsecapp.exe[182812] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessA                                                                                                                                                             00007ffc22e84ab0 6 bytes {JMP QWORD [RIP+0x15b580]}
.text    C:\WINDOWS\system32\wbem\unsecapp.exe[182812] C:\WINDOWS\system32\KERNEL32.DLL!CreateProcessW                                                                                                                                                             00007ffc22e87b30 6 bytes {JMP QWORD [RIP+0x178500]}
.text    C:\WINDOWS\system32\wbem\unsecapp.exe[182812] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW + 198                                                                                                                                                     00007ffc22618e46 3 bytes [C4, 71, 11]
.text    C:\WINDOWS\system32\wbem\unsecapp.exe[182812] C:\WINDOWS\system32\ADVAPI32.dll!CreateProcessWithLogonW                                                                                                                                                    00007ffc24cbef80 6 bytes {JMP QWORD [RIP+0x710b0]}

---- Threads - GMER 2.1 ----

Thread   C:\Windows\System32\WUDFHost.exe [2624:174100]                                                                                                                                                                                                            00007ffc10a630d0
Thread   C:\WINDOWS\system32\csrss.exe [180804:173744]                                                                                                                                                                                                             fffff960008132d0
---- Processes - GMER 2.1 ----

Process  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (FILE NOT FOUND)                                                                                              0000000000400000
Library  c:\users\dana\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp27hanx.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-07-22 11:32:41)                                       0000000005440000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24)           000000006c990000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (ICU I18N DLL/The ICU Project)(2015-03-04 21:45:30)                                                           000000004a900000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (ICU Common DLL/The ICU Project)(2015-03-04 21:45:30)                                                         0000000005f50000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (ICU Data DLL/The ICU Project)(2015-03-04 21:45:30)                                                           000000004ad00000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)        000000006c570000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            000000006ab50000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-03-04 21:45:30)                                                                                        000000006dc30000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)        000000006a790000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)         0000000064990000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)          000000006a570000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            000000006a310000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            00000000727b0000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-03-04 21:45:30)                                                                                           0000000073670000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)  00000000702d0000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)         000000006e9e0000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)   000000006ddc0000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-03-04 21:45:30)                                                                       000000006d200000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-03-04 21:45:30)                                                                       000000006e750000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-03-04 21:45:30)                                                                         0000000072f00000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-03-04 21:45:30)                                                           000000006e820000
Library  C:\Users\Dana\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll (*** suspicious ***) @ C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe [139136](2015-03-04 21:45:30)                                                                    0000000072df0000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                                                     unknown MBR code

---- EOF - GMER 2.1 ----
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlaufdatum: 23.07.2015
Suchlaufzeit: 13:48
Protokolldatei: mbam.txt
Administrator: Ja

Version: 2.1.8.1057
Malware-Datenbank: v2015.07.23.02
Rootkit-Datenbank: v2015.07.22.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Dana

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 349587
Abgelaufene Zeit: 28 Min., 52 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 0
(keine bösartigen Elemente erkannt)

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
         

# AdwCleaner v4.208 - Bericht erstellt 24/07/2015 um 00:22:54
# Aktualisiert 09/07/2015 von Xplode
# Datenbank : 2015-07-15.1 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Dana - LENOVO-D
# Gestarted von : C:\Users\Dana\Downloads\AdwCleaner_4.208.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:57800;hxxps=127.0.0.1:57800
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v39.0 (x86 de)


*************************

AdwCleaner[R0].txt - [9924 Bytes] - [12/01/2015 19:55:40]
AdwCleaner[R1].txt - [2430 Bytes] - [06/03/2015 14:05:04]
AdwCleaner[R2].txt - [1886 Bytes] - [09/07/2015 12:36:42]
AdwCleaner[R3].txt - [1731 Bytes] - [24/07/2015 00:21:04]
AdwCleaner[S0].txt - [8908 Bytes] - [12/01/2015 20:02:21]
AdwCleaner[S1].txt - [2394 Bytes] - [06/03/2015 14:10:26]
AdwCleaner[S2].txt - [1669 Bytes] - [09/07/2015 12:38:09]
AdwCleaner[S3].txt - [1421 Bytes] - [24/07/2015 00:22:54]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1480  Bytes] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.1 (07.16.2015:1)
OS: Windows 8.1 x64
Ran by Dana on 24.07.2015 at  0:51:33,19
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\myfree codec
Successfully deleted: [Folder] C:\ProgramData\productdata
Successfully deleted: [Folder] C:\Users\Dana\AppData\Roaming\productdata



~~~ FireFox

Emptied folder: C:\Users\Dana\AppData\Roaming\mozilla\firefox\profiles\r687zc0f.default-1421086628845\minidumps [1 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.07.2015 at  7:58:48,44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Dana (administrator) on LENOVO-D on 24-07-2015 08:46:29
Running from C:\Users\Dana\Downloads
Loaded Profiles: Dana (Available Profiles: Dana)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-02-26] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2891080 2013-10-17] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216576 2014-03-10] (Realtek Semiconductor Corporation)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2014-02-27] (Realtek semiconductor)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-09-27] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-09-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-07-19] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1565504 2015-02-24] (Samsung)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Amazon Music] => C:\Users\Dana\AppData\Local\Amazon Music\Amazon Music Helper.exe [5887808 2015-07-17] ()
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Spotify Web Helper] => C:\Users\Dana\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2008632 2015-07-14] (Spotify Ltd)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Google Update] => C:\Users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-03-28] (Google Inc.)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Dropbox Update] => C:\Users\Dana\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
Startup: C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-05-03]
ShortcutTarget: Dropbox.lnk -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-07-19] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:57800;https=127.0.0.1:57800
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://lenovo13.msn.com/?pc=LCJB
hxxp://www.lenovo.com
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-07-19] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-19] (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{09E75A22-3EE0-4CEC-BDCD-5D51898E5AC0}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2A6509CE-CD0E-4DC3-A963-53BBA333FDAE}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\r687zc0f.default-1421086628845
FF NewTab: www.google.com
FF SelectedSearchEngine: Yahoo!
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Dana\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @talk.google.com/O1DPlugin -> C:\Users\Dana\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Dana\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Dana\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-07-19]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-19]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-07-19] (AVAST Software)
S2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [95232 2014-03-27] () [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
S2 ETDService; C:\Program Files\Elantech\ETDService.exe [99632 2013-10-09] (ELAN Microelectronics Corp.)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-02-26] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
S2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
S2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-09-27] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272440 2015-03-09] (Lenovo)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
S2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
S2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-09-27] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-07-19] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-07-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-07-19] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-07-19] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1048856 2015-07-19] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447944 2015-07-19] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150160 2015-07-19] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-07-19] (AVAST Software)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-24] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [559832 2014-02-26] (Realtek Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [9109720 2014-02-27] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2982104 2013-12-26] (Realtek Semiconductor Corporation                           )
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-24 08:46 - 2015-07-24 08:46 - 02135552 _____ (Farbar) C:\Users\Dana\Downloads\FRST64.exe
2015-07-24 08:46 - 2015-07-24 08:46 - 00018230 _____ C:\Users\Dana\Downloads\FRST.txt
2015-07-24 07:58 - 2015-07-24 07:58 - 00000940 _____ C:\Users\Dana\Desktop\JRT.txt
2015-07-24 00:39 - 2015-07-24 00:39 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Dana\Downloads\JRT.exe
2015-07-24 00:29 - 2015-07-24 00:29 - 00001560 _____ C:\Users\Dana\Desktop\AdwCleaner[S3].txt
2015-07-23 14:19 - 2015-07-23 14:19 - 00001185 _____ C:\Users\Dana\Desktop\mbam.txt
2015-07-23 13:39 - 2015-07-23 13:40 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Dana\Downloads\mbam-setup-2.1.6.1022.exe
2015-07-23 08:20 - 2015-07-23 08:20 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-22 14:50 - 2015-07-22 14:50 - 00000000 ____D C:\WINDOWS\Minidump
2015-07-22 08:49 - 2015-07-24 08:46 - 00000000 ____D C:\FRST
2015-07-22 08:37 - 2015-07-22 08:37 - 00000000 _____ C:\Users\Dana\defogger_reenable
2015-07-21 11:09 - 2015-07-14 16:14 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-07-21 11:09 - 2015-07-14 16:14 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-07-21 11:09 - 2015-07-14 16:14 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-07-21 11:09 - 2015-07-14 16:13 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-07-20 09:48 - 2015-07-20 09:49 - 92110026 _____ C:\Users\Dana\Downloads\xvideos.com_410297d19300ebf948c379f87621ed60.mp4
2015-07-19 21:21 - 2015-07-22 08:55 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\thriXXX
2015-07-19 21:21 - 2015-07-19 21:25 - 00000000 ____D C:\Users\Dana\AppData\Roaming\thriXXX
2015-07-19 21:21 - 2015-07-19 21:21 - 00000000 ____D C:\ProgramData\thriXXX
2015-07-19 21:21 - 2015-07-19 21:21 - 00000000 ____D C:\Program Files (x86)\thriXXX
2015-07-19 13:25 - 2015-07-24 00:26 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-07-19 13:24 - 2015-07-23 13:46 - 00001129 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-19 13:24 - 2015-07-23 13:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-19 13:24 - 2015-07-23 13:46 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-19 13:24 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-07-19 13:24 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-07-19 13:24 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-07-19 13:23 - 2015-07-19 13:23 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Dana\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-19 09:39 - 2015-07-19 09:39 - 00000000 ____D C:\Users\Dana\AppData\Roaming\AVAST Software
2015-07-19 09:37 - 2015-07-19 09:37 - 00001949 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-07-19 09:37 - 2015-07-19 09:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-19 09:36 - 2015-07-23 08:18 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-07-19 09:36 - 2015-07-19 09:35 - 01048856 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00447944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00378880 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-07-19 09:36 - 2015-07-19 09:35 - 00274808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00150160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00093528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00090968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00065224 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00028656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-07-19 09:35 - 2015-07-19 09:35 - 00043112 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-07-19 09:34 - 2015-07-19 09:34 - 00000000 ____D C:\Program Files\AVAST Software
2015-07-19 09:32 - 2015-07-19 09:32 - 00000000 ____D C:\ProgramData\AVAST Software
2015-07-19 09:11 - 2015-05-12 15:19 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2015-07-18 08:13 - 2015-06-30 00:43 - 00026288 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-07-18 08:13 - 2015-06-29 17:07 - 01145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-07-18 08:13 - 2015-06-27 01:21 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-07-18 08:13 - 2015-06-27 01:21 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-07-16 10:08 - 2015-05-07 19:50 - 22292672 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-07-16 10:08 - 2015-05-07 19:00 - 03109376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2015-07-16 10:08 - 2015-05-07 18:53 - 19734960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-07-16 10:08 - 2015-05-07 18:12 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2015-07-16 10:08 - 2015-05-07 17:21 - 00522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\GeofenceMonitorService.dll
2015-07-16 10:08 - 2015-05-07 17:05 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll
2015-07-16 10:08 - 2015-05-03 02:39 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-07-16 10:08 - 2015-04-30 01:22 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2015-07-16 10:07 - 2015-05-11 20:17 - 01201664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2015-07-16 10:07 - 2015-05-11 18:34 - 00332800 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll
2015-07-16 10:07 - 2015-05-03 17:09 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-16 10:07 - 2015-05-03 17:07 - 07784448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2015-07-16 10:07 - 2015-05-03 16:58 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-16 10:07 - 2015-05-03 16:57 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2015-07-16 10:07 - 2015-05-03 16:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2015-07-16 10:07 - 2015-05-03 16:49 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2015-07-16 10:07 - 2015-05-02 01:33 - 00410739 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-07-16 10:07 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\SysWOW64\locale.nls
2015-07-16 10:07 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\system32\locale.nls
2015-07-16 10:07 - 2015-04-25 04:25 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usb8023.sys
2015-07-16 10:07 - 2015-04-23 17:47 - 03084288 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-07-16 10:07 - 2015-04-23 17:16 - 02471424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-07-16 10:07 - 2014-11-04 21:25 - 00059712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdclass.sys
2015-07-16 10:07 - 2014-11-04 21:25 - 00051008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouclass.sys
2015-07-16 10:07 - 2014-11-04 08:55 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sermouse.sys
2015-07-16 10:07 - 2014-11-04 08:54 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\i8042prt.sys
2015-07-16 10:07 - 2014-11-04 08:54 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys
2015-07-16 10:07 - 2014-11-04 08:54 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouhid.sys
2015-07-15 11:02 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2015-07-15 11:02 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-07-15 11:02 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2015-07-15 11:02 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2015-07-15 11:02 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2015-07-15 11:02 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2015-07-15 11:02 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2015-07-15 11:02 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2015-07-15 11:02 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-07-15 11:02 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-07-15 11:02 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-07-15 11:02 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-07-15 11:02 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-07-15 11:02 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-07-15 11:02 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2015-07-15 11:02 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2015-07-15 11:02 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2015-07-15 11:02 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2015-07-15 11:02 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-07-15 11:02 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-07-15 11:01 - 2015-07-09 21:51 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-07-15 11:01 - 2015-07-09 20:40 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-07-15 11:01 - 2015-07-09 18:03 - 03701760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-07-15 11:01 - 2015-07-09 17:54 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-07-15 11:01 - 2015-07-09 17:53 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-07-15 11:01 - 2015-07-09 17:50 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-07-15 11:01 - 2015-07-09 17:50 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-07-15 11:01 - 2015-07-09 17:48 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-07-15 11:01 - 2015-07-09 17:46 - 02229248 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-07-15 11:01 - 2015-07-09 17:38 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-07-15 11:01 - 2015-07-09 17:37 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-07-15 11:01 - 2015-07-09 17:35 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-07-15 11:01 - 2015-07-09 17:34 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-07-15 11:01 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-07-15 11:01 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-07-15 11:01 - 2015-06-27 05:08 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-07-15 11:01 - 2015-06-27 05:08 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-07-15 11:01 - 2015-06-27 04:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-07-15 11:01 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-07-15 11:01 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-07-15 11:01 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-07-15 11:00 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-07-15 11:00 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-07-15 10:59 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-07-15 10:59 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-07-15 10:59 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-07-15 10:59 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-07-15 10:59 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-07-15 10:59 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-07-15 10:59 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-07-15 10:59 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-07-15 10:59 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-07-15 10:59 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-07-15 10:59 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2015-07-15 10:59 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2015-07-15 10:59 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-07-15 10:59 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-07-15 10:59 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-07-15 10:59 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-07-15 10:59 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-07-15 10:59 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-07-15 10:59 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-07-15 10:59 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-07-15 10:59 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-07-15 10:59 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-07-15 10:59 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-07-15 10:59 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-07-15 10:59 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-07-15 10:59 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-07-15 10:59 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2015-07-15 10:59 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2015-07-15 10:59 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-07-15 10:59 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-07-15 10:59 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-07-15 10:59 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-07-15 10:59 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-07-15 10:59 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-07-15 10:59 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-07-15 10:59 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-07-15 10:59 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-07-15 10:59 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-07-15 10:59 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-07-15 10:58 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2015-07-15 10:58 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2015-07-15 10:58 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-07-15 10:58 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-07-15 10:58 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll
2015-07-14 19:42 - 2015-07-14 19:42 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Dana\Downloads\spybot2-license.exe
2015-07-07 16:04 - 2015-07-07 20:40 - 00012465 _____ C:\Users\Dana\Documents\Fragen Paket.de.odt
2015-07-07 12:21 - 2015-07-09 12:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-27 06:49 - 2015-06-27 06:50 - 89039562 _____ C:\Users\Dana\Downloads\Welcome.zip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-24 08:43 - 2015-01-03 21:59 - 00003926 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{91E03A35-91AC-4E7C-8AC3-167C4C714877}
2015-07-24 08:33 - 2015-03-28 17:15 - 00001134 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job
2015-07-24 08:23 - 2015-06-16 08:13 - 00001238 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job
2015-07-24 07:52 - 2015-01-14 13:22 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-07-24 07:32 - 2015-03-28 17:15 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job
2015-07-24 07:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-07-24 03:19 - 2014-09-27 06:08 - 01410426 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-24 02:07 - 2014-09-27 06:44 - 04076672 _____ C:\Users\Public\CAFADEBUG.log
2015-07-24 02:06 - 2014-09-27 07:34 - 00006656 _____ C:\WINDOWS\system32\VfService.trf
2015-07-24 00:38 - 2013-08-22 16:46 - 00084130 _____ C:\WINDOWS\setupact.log
2015-07-24 00:29 - 2015-05-03 10:30 - 00000000 ___RD C:\Users\Dana\Dropbox
2015-07-24 00:29 - 2015-05-03 10:27 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Dropbox
2015-07-24 00:28 - 2015-03-06 14:09 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Nitro PDF
2015-07-24 00:26 - 2015-01-03 20:24 - 00731570 _____ C:\Users\Dana\AppData\Local\BTServer.log
2015-07-24 00:24 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-07-24 00:24 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-07-24 00:23 - 2015-01-12 19:55 - 00000000 ____D C:\AdwCleaner
2015-07-24 00:06 - 2013-08-22 16:44 - 00377296 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-07-23 14:18 - 2015-01-03 20:31 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1602078527-2339295992-2746922436-1001
2015-07-23 13:26 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-07-23 09:23 - 2015-06-16 08:13 - 00001186 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job
2015-07-22 14:51 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\WinStore
2015-07-22 14:49 - 2014-09-27 06:00 - 00217029 ____N C:\WINDOWS\Minidump\072215-102000-01.dmp
2015-07-22 14:49 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-07-22 14:48 - 2014-03-18 11:44 - 00461824 _____ C:\WINDOWS\PFRO.log
2015-07-22 08:37 - 2015-01-03 20:23 - 00000000 ____D C:\Users\Dana
2015-07-19 16:18 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-07-19 14:41 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-07-19 14:37 - 2015-01-13 22:37 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-07-19 14:37 - 2015-01-13 22:37 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-07-19 14:36 - 2015-01-12 23:18 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-07-19 09:40 - 2015-01-12 19:16 - 00000000 ____D C:\ProgramData\Avira
2015-07-19 09:40 - 2014-09-27 06:48 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-19 09:39 - 2015-01-03 20:25 - 00000000 ____D C:\Users\Dana\AppData\Local\VirtualStore
2015-07-19 09:18 - 2015-06-16 08:13 - 00004182 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA
2015-07-19 09:18 - 2015-06-16 08:13 - 00003802 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core
2015-07-19 08:50 - 2015-04-04 19:32 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-07-19 08:50 - 2015-04-04 19:32 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-07-18 22:58 - 2015-01-12 13:12 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-16 07:27 - 2015-03-28 17:15 - 00004078 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA
2015-07-16 07:27 - 2015-03-28 17:15 - 00003698 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core
2015-07-15 23:04 - 2015-02-23 17:47 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Spotify
2015-07-15 22:45 - 2015-02-23 17:48 - 00000000 ____D C:\Users\Dana\AppData\Local\Spotify
2015-07-14 20:47 - 2015-01-03 20:29 - 00000000 ____D C:\Users\Dana\AppData\Local\Adobe
2015-07-14 20:45 - 2015-01-14 13:22 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-07-14 19:44 - 2015-01-12 13:12 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 23:10 - 2015-01-14 12:55 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2015-01-14 12:55 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-10 16:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-07-09 18:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-07-09 13:54 - 2015-02-04 09:58 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieBrowserModeList
2015-07-09 13:54 - 2015-01-12 13:03 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieUserList
2015-07-09 13:54 - 2015-01-12 13:03 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieSiteList
2015-07-09 12:41 - 2015-01-12 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-07 13:20 - 2015-01-16 15:50 - 00001142 _____ C:\Users\Dana\Desktop\Amazon Music.lnk
2015-07-03 08:43 - 2015-01-12 23:18 - 130333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2015-01-03 20:24 - 2015-07-24 00:26 - 0731570 _____ () C:\Users\Dana\AppData\Local\BTServer.log
2014-09-27 06:44 - 2014-09-27 06:44 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Dana\AppData\Local\Temp\avgnt.exe
C:\Users\Dana\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpb3roob.dll
C:\Users\Dana\AppData\Local\Temp\Quarantine.exe
C:\Users\Dana\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-24 08:00

==================== End of log ============================
         

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

 Results of screen317's Security Check version 1.004  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Spybot - Search and Destroy   
Windows Defender              
avast! Antivirus              
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Spybot - Search & Destroy 
 Adobe Flash Player 	18.0.0.209  
 Mozilla Firefox (39.0) 
````````Process Check: objlist.exe by Laurent````````  
 Lenovo FusionEngine AvastSvc.exe -?-  
 Lenovo FusionEngine AvastUI.exe -?-  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=3f492b75558ba9488ca8bccf4ec4754e
# end=init
# utc_time=2015-07-24 04:28:18
# local_time=2015-07-24 06:28:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 24962
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=3f492b75558ba9488ca8bccf4ec4754e
# end=updated
# utc_time=2015-07-24 04:45:01
# local_time=2015-07-24 06:45:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=3f492b75558ba9488ca8bccf4ec4754e
# engine=24962
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-24 06:12:00
# local_time=2015-07-24 08:12:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 88 192186 470377 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 10998487 25935276 0 0
# scanned=239890
# found=21
# cleaned=21
# scan_time=5218
sh=7D99FBA462856BC4DD46A7B18E1D79D1C2BC0789 ft=1 fh=0c98b06ccc654f7d vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\cltmng.exe.vir"
sh=01B1F9CB2D50A5609593744320463E46B91EEED4 ft=1 fh=769d3a4457a9efb0 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPTool64.exe.vir"
sh=C91A0FA1B6D1087BFFF881365E2985A011B401C2 ft=1 fh=4fa76ddc1441696b vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32.dll.vir"
sh=FA71B8789F7BB0D1FC4A4F6EB9E082D234DD4E8A ft=1 fh=5c4c6b425e2cebc2 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32Loader.dll.vir"
sh=8FF3027FD5B24AF549A476472735F525E5A82E79 ft=1 fh=8958c815348aafc1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64.dll.vir"
sh=FED4EF394C9023B1005081D803BCB7777479CD19 ft=1 fh=d176c9757a5542b1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64Loader.dll.vir"
sh=621A43829E928D10CDA8CE4ECCF5C11E6BCFD5A8 ft=1 fh=1402f114ad354e9d vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\Main\bin\CltMngSvc.exe.vir"
sh=DDB78884545DF16760E10BFC482D1719DDCA5C90 ft=1 fh=3db9760f8b27cec5 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\Main\bin\SPTool.dll.vir"
sh=E56595B052627D2E0F79BFEB1113B85CF5E373DB ft=1 fh=fd73c4a1721c52d6 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\Main\bin\uninstall.exe.vir"
sh=1B64473A9F6DC51107678E8649727FADE9D9B4F2 ft=1 fh=d771a5c9edd3de6b vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\UI\bin\cltmngui.exe.vir"
sh=C0B7F8C09DB0ADA3DF2102A3D08FAC9781A15DC6 ft=1 fh=55bf436402755b8c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir"
sh=52F9085A177DC911DC513ED9FA431A58126F73CF ft=1 fh=08f0a6962a427f0c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir"
sh=FBDFC5A9C45940E1EE1DB6ADFCE2B1BD5DD301F3 ft=1 fh=c71c0011210d5c57 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"
sh=3E365578C151761F5E799B2A06A0C4B5AB293B7B ft=1 fh=641afd291d079167 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir"
sh=EAE26C38934A5DFC7EB58B885FCC83DA388D5AE1 ft=1 fh=bf40033c211bd84f vn="Win32/ELEX.BM evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir"
sh=D4A43936353E001F542FB287278ED350644F1917 ft=1 fh=cf34ce2fc97c23ab vn="Win32/ELEX.BM evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir"
sh=062ABDCB56570C442DED18676BAA1D9A0D807429 ft=1 fh=a6caf9f716b3d3da vn="Variante von Win32/RiskWare.Astori.C Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Dana\AppData\Roaming\InetStat\inetstat.exe.vir"
sh=728D952AC1492F8331E2ED29921D5DDB8658697A ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\mxfm0i7c.default\Extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js.vir"
sh=4CF9EF4D739C2F8A1F3909A2720274527EC29E1F ft=1 fh=c71c001143f2d9bd vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Dana\AppData\Roaming\webssearches\UninstallManager.exe.vir"
sh=9CE5F659BDD89907624541CB98681224CA75D886 ft=1 fh=9b9a5086efdbb0a1 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\WINDOWS\System32\roboot64.exe.vir"
sh=C0E28878041F7708BC82DD28153719E88A91C1BA ft=1 fh=0e746c2d3c3fdba6 vn="Win32/Systweak evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Dana\Downloads\Setup_WinThruster_2015.exe"
         

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Dana (administrator) on LENOVO-D on 24-07-2015 21:20:43
Running from C:\Users\Dana\Downloads
Loaded Profiles: Dana (Available Profiles: Dana)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
() C:\Users\Dana\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Spotify Ltd) C:\Users\Dana\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Dropbox, Inc.) C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files\lenovo\Lenovo Solution Center\LSCNotify.exe
() C:\Users\Dana\Downloads\SecurityCheck.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-02-26] (Intel Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2891080 2013-10-17] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216576 2014-03-10] (Realtek Semiconductor Corporation)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2014-02-27] (Realtek semiconductor)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-09-27] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-09-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-07-19] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1565504 2015-02-24] (Samsung)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Amazon Music] => C:\Users\Dana\AppData\Local\Amazon Music\Amazon Music Helper.exe [5887808 2015-07-17] ()
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Spotify Web Helper] => C:\Users\Dana\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2008632 2015-07-14] (Spotify Ltd)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Google Update] => C:\Users\Dana\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-03-28] (Google Inc.)
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\...\Run: [Dropbox Update] => C:\Users\Dana\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
Startup: C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-05-03]
ShortcutTarget: Dropbox.lnk -> C:\Users\Dana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dana\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-07-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-07-19] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll [2014-06-23] (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:57800;https=127.0.0.1:57800
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://lenovo13.msn.com/?pc=LCJB
hxxp://www.lenovo.com
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-07-19] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-19] (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{09E75A22-3EE0-4CEC-BDCD-5D51898E5AC0}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2A6509CE-CD0E-4DC3-A963-53BBA333FDAE}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\r687zc0f.default-1421086628845
FF NewTab: www.google.com
FF SelectedSearchEngine: Yahoo!
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Dana\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @talk.google.com/O1DPlugin -> C:\Users\Dana\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1602078527-2339295992-2746922436-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Dana\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Dana\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Dana\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-07-19]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-07-19]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-19]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-07-19] (AVAST Software)
S2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [95232 2014-03-27] () [File not signed]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
S2 ETDService; C:\Program Files\Elantech\ETDService.exe [99632 2013-10-09] (ELAN Microelectronics Corp.)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-02-26] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
S2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
S2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-09-27] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272440 2015-03-09] (Lenovo)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
S2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-09-27] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-07-19] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-07-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-07-19] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-07-19] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1048856 2015-07-19] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447944 2015-07-19] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150160 2015-07-19] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-07-19] (AVAST Software)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-24] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [559832 2014-02-26] (Realtek Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [9109720 2014-02-27] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2982104 2013-12-26] (Realtek Semiconductor Corporation                           )
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [64160 2014-04-25] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-24 21:20 - 2015-07-24 21:21 - 00020010 _____ C:\Users\Dana\Downloads\FRST.txt
2015-07-24 21:20 - 2015-07-24 21:20 - 02135552 _____ (Farbar) C:\Users\Dana\Downloads\FRST64.exe
2015-07-24 21:19 - 2015-07-24 21:19 - 00000790 _____ C:\Users\Dana\Desktop\checkup.txt
2015-07-24 20:24 - 2015-07-24 20:24 - 00852662 _____ C:\Users\Dana\Downloads\SecurityCheck.exe
2015-07-24 18:26 - 2015-07-24 18:27 - 02870984 _____ (ESET) C:\Users\Dana\Downloads\esetsmartinstaller_deu.exe
2015-07-24 00:39 - 2015-07-24 00:39 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Dana\Downloads\JRT.exe
2015-07-23 08:20 - 2015-07-23 08:20 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-22 14:50 - 2015-07-22 14:50 - 00000000 ____D C:\WINDOWS\Minidump
2015-07-22 08:49 - 2015-07-24 21:20 - 00000000 ____D C:\FRST
2015-07-22 08:37 - 2015-07-22 08:37 - 00000000 _____ C:\Users\Dana\defogger_reenable
2015-07-21 11:09 - 2015-07-14 16:14 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-07-21 11:09 - 2015-07-14 16:14 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-07-21 11:09 - 2015-07-14 16:14 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-07-21 11:09 - 2015-07-14 16:13 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-07-20 09:48 - 2015-07-20 09:49 - 92110026 _____ C:\Users\Dana\Downloads\xvideos.com_410297d19300ebf948c379f87621ed60.mp4
2015-07-19 21:21 - 2015-07-22 08:55 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\thriXXX
2015-07-19 21:21 - 2015-07-19 21:25 - 00000000 ____D C:\Users\Dana\AppData\Roaming\thriXXX
2015-07-19 21:21 - 2015-07-19 21:21 - 00000000 ____D C:\ProgramData\thriXXX
2015-07-19 21:21 - 2015-07-19 21:21 - 00000000 ____D C:\Program Files (x86)\thriXXX
2015-07-19 13:25 - 2015-07-24 00:26 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-07-19 13:24 - 2015-07-23 13:46 - 00001129 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-19 13:24 - 2015-07-23 13:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-07-19 13:24 - 2015-07-23 13:46 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-07-19 13:24 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-07-19 13:24 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-07-19 13:24 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-07-19 09:39 - 2015-07-19 09:39 - 00000000 ____D C:\Users\Dana\AppData\Roaming\AVAST Software
2015-07-19 09:37 - 2015-07-19 09:37 - 00001949 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-07-19 09:37 - 2015-07-19 09:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-19 09:36 - 2015-07-23 08:18 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-07-19 09:36 - 2015-07-19 09:35 - 01048856 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00447944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00378880 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-07-19 09:36 - 2015-07-19 09:35 - 00274808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00150160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00093528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00090968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00065224 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-07-19 09:36 - 2015-07-19 09:35 - 00028656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-07-19 09:35 - 2015-07-19 09:35 - 00043112 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-07-19 09:34 - 2015-07-19 09:34 - 00000000 ____D C:\Program Files\AVAST Software
2015-07-19 09:32 - 2015-07-19 09:32 - 00000000 ____D C:\ProgramData\AVAST Software
2015-07-19 09:11 - 2015-05-12 15:19 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2015-07-18 08:13 - 2015-06-30 00:43 - 00026288 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-07-18 08:13 - 2015-06-29 17:07 - 01145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-07-18 08:13 - 2015-06-29 17:07 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-07-18 08:13 - 2015-06-27 01:21 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-07-18 08:13 - 2015-06-27 01:21 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-07-16 10:08 - 2015-05-07 19:50 - 22292672 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-07-16 10:08 - 2015-05-07 19:00 - 03109376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2015-07-16 10:08 - 2015-05-07 18:53 - 19734960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-07-16 10:08 - 2015-05-07 18:12 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2015-07-16 10:08 - 2015-05-07 17:21 - 00522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\GeofenceMonitorService.dll
2015-07-16 10:08 - 2015-05-07 17:05 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll
2015-07-16 10:08 - 2015-05-03 02:39 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-07-16 10:08 - 2015-04-30 01:22 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2015-07-16 10:07 - 2015-05-11 20:17 - 01201664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2015-07-16 10:07 - 2015-05-11 18:34 - 00332800 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll
2015-07-16 10:07 - 2015-05-03 17:09 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-16 10:07 - 2015-05-03 17:07 - 07784448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2015-07-16 10:07 - 2015-05-03 16:58 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-16 10:07 - 2015-05-03 16:57 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2015-07-16 10:07 - 2015-05-03 16:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2015-07-16 10:07 - 2015-05-03 16:49 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2015-07-16 10:07 - 2015-05-02 01:33 - 00410739 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-07-16 10:07 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\SysWOW64\locale.nls
2015-07-16 10:07 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\system32\locale.nls
2015-07-16 10:07 - 2015-04-25 04:25 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usb8023.sys
2015-07-16 10:07 - 2015-04-23 17:47 - 03084288 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-07-16 10:07 - 2015-04-23 17:16 - 02471424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-07-16 10:07 - 2014-11-04 21:25 - 00059712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdclass.sys
2015-07-16 10:07 - 2014-11-04 21:25 - 00051008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouclass.sys
2015-07-16 10:07 - 2014-11-04 08:55 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sermouse.sys
2015-07-16 10:07 - 2014-11-04 08:54 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\i8042prt.sys
2015-07-16 10:07 - 2014-11-04 08:54 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys
2015-07-16 10:07 - 2014-11-04 08:54 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouhid.sys
2015-07-15 11:02 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2015-07-15 11:02 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-07-15 11:02 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2015-07-15 11:02 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2015-07-15 11:02 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2015-07-15 11:02 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2015-07-15 11:02 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2015-07-15 11:02 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2015-07-15 11:02 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-07-15 11:02 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-07-15 11:02 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-07-15 11:02 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-07-15 11:02 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-07-15 11:02 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-07-15 11:02 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2015-07-15 11:02 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2015-07-15 11:02 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2015-07-15 11:02 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2015-07-15 11:02 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-07-15 11:02 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-07-15 11:01 - 2015-07-09 21:51 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-07-15 11:01 - 2015-07-09 20:40 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-07-15 11:01 - 2015-07-09 18:03 - 03701760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-07-15 11:01 - 2015-07-09 17:54 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-07-15 11:01 - 2015-07-09 17:53 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-07-15 11:01 - 2015-07-09 17:50 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-07-15 11:01 - 2015-07-09 17:50 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-07-15 11:01 - 2015-07-09 17:48 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-07-15 11:01 - 2015-07-09 17:46 - 02229248 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-07-15 11:01 - 2015-07-09 17:38 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-07-15 11:01 - 2015-07-09 17:37 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-07-15 11:01 - 2015-07-09 17:35 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-07-15 11:01 - 2015-07-09 17:34 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-07-15 11:01 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-07-15 11:01 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-07-15 11:01 - 2015-06-27 05:08 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-07-15 11:01 - 2015-06-27 05:08 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-07-15 11:01 - 2015-06-27 04:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-07-15 11:01 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-07-15 11:01 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-07-15 11:01 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-07-15 11:00 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-07-15 11:00 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-07-15 10:59 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-07-15 10:59 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-07-15 10:59 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-07-15 10:59 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-07-15 10:59 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-07-15 10:59 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-07-15 10:59 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-07-15 10:59 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-07-15 10:59 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-07-15 10:59 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-07-15 10:59 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2015-07-15 10:59 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2015-07-15 10:59 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-07-15 10:59 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-07-15 10:59 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-07-15 10:59 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-07-15 10:59 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-07-15 10:59 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-07-15 10:59 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-07-15 10:59 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-07-15 10:59 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-07-15 10:59 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-07-15 10:59 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-07-15 10:59 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-07-15 10:59 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-07-15 10:59 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-07-15 10:59 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2015-07-15 10:59 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2015-07-15 10:59 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-07-15 10:59 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-07-15 10:59 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-07-15 10:59 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-07-15 10:59 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-07-15 10:59 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-07-15 10:59 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-07-15 10:59 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-07-15 10:59 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-07-15 10:59 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-07-15 10:59 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-07-15 10:58 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2015-07-15 10:58 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2015-07-15 10:58 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-07-15 10:58 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-07-15 10:58 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll
2015-07-14 19:42 - 2015-07-14 19:42 - 00558328 _____ (Safer-Networking Ltd. ) C:\Users\Dana\Downloads\spybot2-license.exe
2015-07-07 16:04 - 2015-07-07 20:40 - 00012465 _____ C:\Users\Dana\Documents\Fragen Paket.de.odt
2015-07-07 12:21 - 2015-07-09 12:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-27 06:49 - 2015-06-27 06:50 - 89039562 _____ C:\Users\Dana\Downloads\Welcome.zip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-24 21:10 - 2015-01-03 21:59 - 00003926 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{91E03A35-91AC-4E7C-8AC3-167C4C714877}
2015-07-24 21:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-07-24 20:52 - 2015-01-14 13:22 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-07-24 20:32 - 2015-03-28 17:15 - 00001134 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job
2015-07-24 20:23 - 2015-06-16 08:13 - 00001238 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA.job
2015-07-24 17:58 - 2014-09-27 06:08 - 01573769 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-24 15:09 - 2015-05-03 10:30 - 00000000 ___RD C:\Users\Dana\Dropbox
2015-07-24 15:09 - 2015-05-03 10:27 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Dropbox
2015-07-24 15:04 - 2015-03-06 14:09 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Nitro PDF
2015-07-24 15:00 - 2015-01-03 20:24 - 00735275 _____ C:\Users\Dana\AppData\Local\BTServer.log
2015-07-24 13:56 - 2015-02-23 17:48 - 00000000 ____D C:\Users\Dana\AppData\Local\Spotify
2015-07-24 13:56 - 2014-09-27 06:44 - 04092132 _____ C:\Users\Public\CAFADEBUG.log
2015-07-24 13:49 - 2015-01-03 20:31 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1602078527-2339295992-2746922436-1001
2015-07-24 13:32 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-07-24 13:27 - 2015-02-23 17:47 - 00000000 ____D C:\Users\Dana\AppData\Roaming\Spotify
2015-07-24 12:35 - 2013-08-22 16:46 - 00084279 _____ C:\WINDOWS\setupact.log
2015-07-24 09:23 - 2015-06-16 08:13 - 00001186 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job
2015-07-24 08:59 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-07-24 07:32 - 2015-03-28 17:15 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core.job
2015-07-24 02:06 - 2014-09-27 07:34 - 00006656 _____ C:\WINDOWS\system32\VfService.trf
2015-07-24 00:24 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-07-24 00:24 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-07-24 00:23 - 2015-01-12 19:55 - 00000000 ____D C:\AdwCleaner
2015-07-24 00:06 - 2013-08-22 16:44 - 00377296 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-07-23 13:26 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-07-22 14:51 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\WinStore
2015-07-22 14:49 - 2014-09-27 06:00 - 00217029 ____N C:\WINDOWS\Minidump\072215-102000-01.dmp
2015-07-22 14:49 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-07-22 14:48 - 2014-03-18 11:44 - 00461824 _____ C:\WINDOWS\PFRO.log
2015-07-22 08:37 - 2015-01-03 20:23 - 00000000 ____D C:\Users\Dana
2015-07-19 14:37 - 2015-01-13 22:37 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-07-19 14:37 - 2015-01-13 22:37 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-07-19 14:36 - 2015-01-12 23:18 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-07-19 09:40 - 2015-01-12 19:16 - 00000000 ____D C:\ProgramData\Avira
2015-07-19 09:40 - 2014-09-27 06:48 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-19 09:39 - 2015-01-03 20:25 - 00000000 ____D C:\Users\Dana\AppData\Local\VirtualStore
2015-07-19 09:18 - 2015-06-16 08:13 - 00004182 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA
2015-07-19 09:18 - 2015-06-16 08:13 - 00003802 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core
2015-07-19 08:50 - 2015-04-04 19:32 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-07-19 08:50 - 2015-04-04 19:32 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-07-18 22:58 - 2015-01-12 13:12 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-16 07:27 - 2015-03-28 17:15 - 00004078 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001UA
2015-07-16 07:27 - 2015-03-28 17:15 - 00003698 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1602078527-2339295992-2746922436-1001Core
2015-07-14 20:47 - 2015-01-03 20:29 - 00000000 ____D C:\Users\Dana\AppData\Local\Adobe
2015-07-14 20:45 - 2015-01-14 13:22 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-07-14 19:44 - 2015-01-12 13:12 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-13 23:10 - 2015-01-14 12:55 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2015-01-14 12:55 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-10 16:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-07-09 18:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-07-09 13:54 - 2015-02-04 09:58 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieBrowserModeList
2015-07-09 13:54 - 2015-01-12 13:03 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieUserList
2015-07-09 13:54 - 2015-01-12 13:03 - 00000000 __SHD C:\Users\Dana\AppData\Local\EmieSiteList
2015-07-09 12:41 - 2015-01-12 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-07 13:20 - 2015-01-16 15:50 - 00001142 _____ C:\Users\Dana\Desktop\Amazon Music.lnk
2015-07-03 08:43 - 2015-01-12 23:18 - 130333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2015-01-03 20:24 - 2015-07-24 15:00 - 0735275 _____ () C:\Users\Dana\AppData\Local\BTServer.log
2014-09-27 06:44 - 2014-09-27 06:44 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Dana\AppData\Local\Temp\avgnt.exe
C:\Users\Dana\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphng8fi.dll
C:\Users\Dana\AppData\Local\Temp\Quarantine.exe
C:\Users\Dana\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-24 08:00

==================== End of log ============================
         

Die Leiste in der die offenen Tabs sind und auch Minimieren,Maximieren,Schließen angezeigt wird,ich weiß nicht wie man die nennt, die blinkt manchmal.
Ich kann keine Videos im Vollbildmodus gucken, der wird nach 4 min automatisch geschlossen, egel ob YouTube oder Netflix oder so.
Und ich muss mich immer wieder neu anmelden bei diversen Seiten, selbst wenn ich bei "Angemeldet bleiben" einen Haken setze muss ich mich beim nächsten öffnen von Firefox neu anmelden. In den Einstellungen bei Firefx ist aber Passwort speichern und Cookies akzeptieren ausgewählt.

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

RemoveProxy:
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Also das mit Firefox deinstallieren, neuinstallieren und restaurieren hat geklappt, aber dann...

einfach nur die 2 Zeilen in einem leeren Notepad speichern?
bei FRST erscheint kein Fix Button

ich werd immernoch nach ein paar Minuten aus dem Vollbildmodus geschmissen
der Laptop fährt nicht runter, wenn ich auf herunterfahren klick dann wird der Bildschirm kurz schwarz und dann erschein der Sperrbildschirm zur Passworteingabe

FRST gibt es jetzt auf Deutsch, also nicht auf FIx sondern auf Entfernen klicken

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:26-07-2015
durchgeführt von Dana an 2015-07-27 12:33:00 Run:1
Gestartet von C:\Users\Dana\Downloads
Geladene Profile: Dana (Verfügbare Profile: Dana)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
RemoveProxy:
Emptytemp:
*****************


========= RemoveProxy: =========

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => Wert erfolgreich entfernt
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-1602078527-2339295992-2746922436-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt


========= Ende von RemoveProxy: =========

EmptyTemp: => 430.2 MB temporäre Dateien entfernt.


Das System musste neu gestartet werden.. 

==== Ende von Fixlog 12:33:34 ====
         

Frisches FRST log bitte noch. Noch Probleme?