Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Lollipop Network S.L. und weitere

Lollipop Network S.L. und weitere


Log-Analyse und Auswertung: Lollipop Network S.L. und weitere

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 09.02.2014, 11:22   #1
petermuelle
 
Lollipop Network S.L. und weitere - Standard

Lollipop Network S.L. und weitere


Hallo,

gestern habe ich das vielfach beschriebenen Lollipop S.L. Programm auf meinem Laptop entdeckt. AVG hat nichts besonderes feststellen können. Mit Malwarebytes konnte ich ca. 160 Treffer landen, darunter war auch der Lollipop. Nun habe ich immer noch das Problem, das beim surfen mit dem IE oder Firefox ominöse Werbung für Spiele oder angeblicher Schutzsoftware auftaucht.

Hier das Logfile der FRST

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2014
Ran by Stefan (administrator) on PC_HAEMMISCH on 09-02-2014 11:04:00
Running from C:\Users\Stefan\AppData\Local\Microsoft\Windows\INetCache\IE\2FKGMS6E
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Program Files (x86)\Re-markit\Re-markit153.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
() C:\Program Files (x86)\Re-markit\Re-markit_wd.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Lenovo) C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [RtsFT] - C:\WINDOWS\RTFTrack.exe [6340312 2013-09-02] (Realtek semiconductor)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [OnekeyStudio] - C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-09-14] (Lenovo)
HKLM\...\Run: [Energy Manager] - C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2013-12-06] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] - C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2013-12-06] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [Lenovo App Shop] - C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [179976 2013-08-26] (cyberlink)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-20] (APN)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4962320 2014-01-22] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] ( (Atheros Communications))
HKU\S-1-5-21-3974548523-2819813499-3364971708-1002\...\MountPoints2: {7e444ef5-7851-11e3-825e-40f02f5e2160} - "F:\HTC_Sync_Manager_PC.exe" 

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:13828
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {178B6BD3-D755-47F4-A214-375FE29BB332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=LCJB
SearchScopes: HKLM-x32 - {178B6BD3-D755-47F4-A214-375FE29BB332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=LCJB
SearchScopes: HKCU - {178B6BD3-D755-47F4-A214-375FE29BB332} URL = 
BHO: Plus-HD-7.5 - {11111111-1111-1111-1111-110511071176} - C:\Program Files (x86)\Plus-HD-7.5\Plus-HD-7.5-bho64.dll No File
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO-x32: No Name - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} -  No File
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM-x32 {12545791-AC9A-44B2-8964-0DA216C4A4E5} hxxp://kipp.partcommunity.com/FileService/FileLoader/cnsViewer3D/pwebdownloader.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\agqdruib.default
FF Plugin: @cadenas.de/PARTwebViewer - C:\Program Files (x86)\cadenas\partwebviewer\bin\x86\64\npwebviewerplugins.dll (CADENAS GmbH)
FF Plugin-x32: @cadenas.de/PARTwebViewer - C:\Program Files (x86)\cadenas\partwebviewer\bin\x86\32\npwebviewerplugins.dll (CADENAS GmbH)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: intel.com/AppUp - C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp.dll (Intel)
FF Plugin HKCU: intel.com/AppUpx64 - C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll (Intel)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2014-01-19]

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-19]
CHR Extension: (Google Drive) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-19]
CHR Extension: (YouTube) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-19]
CHR Extension: (Google Search) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-19]
CHR Extension: (Google Wallet) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-19]
CHR Extension: (Gmail) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-19]

==================== Services (Whitelisted) =================

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3788816 2014-01-22] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
S2 CLKMSVC10_3A60B698; C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [243464 2013-08-26] (CyberLink)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Re-markit; C:\Program Files (x86)\Re-markit\Re-markit153.exe [180736 2014-02-08] ()
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2013-12-06] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-09-07] (Atheros)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [252728 2013-10-21] (AVG Technologies CZ, s.r.o.)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-07] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8874712 2013-09-02] (Realtek Semiconductor Corp.)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 SmbDrvI; \SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-09 11:03 - 2014-02-09 11:04 - 00000000 ____D () C:\FRST
2014-02-09 10:45 - 2014-02-09 10:45 - 00001008 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-02-09 10:45 - 2014-02-09 10:45 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\AVG2014
2014-02-09 10:44 - 2014-02-09 10:49 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Avg2014
2014-02-09 10:44 - 2014-02-09 10:46 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-09 10:44 - 2014-02-09 10:45 - 00000000 ____D () C:\ProgramData\AVG2014
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ___HD () C:\$AVG
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Users\Stefan\AppData\Local\MFAData
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-02-09 10:41 - 2014-02-09 10:41 - 00123424 _____ () C:\Users\Stefan\Desktop\Lollipop Network, S_L_ - Trojaner-Board.htm
2014-02-09 10:41 - 2014-02-09 10:41 - 00000000 ____D () C:\Users\Stefan\Desktop\Lollipop Network, S_L_ - Trojaner-Board-Dateien
2014-02-09 09:05 - 2014-02-09 09:05 - 00000000 ____D () C:\Users\Stefan\Desktop\Log_File
2014-02-08 22:53 - 2014-01-19 08:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\ProgramData\Mozilla
2014-02-08 21:17 - 2014-02-08 21:17 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Malwarebytes
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 19:29 - 2014-02-08 20:05 - 00000000 ____D () C:\AdwCleaner
2014-02-08 16:52 - 2014-02-08 16:52 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\VOPackage
2014-02-08 16:50 - 2014-02-09 10:48 - 00000398 _____ () C:\WINDOWS\Tasks\Re-markit_wd.job
2014-02-08 16:50 - 2014-02-09 10:45 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\TuneUp Software
2014-02-08 16:50 - 2014-02-08 16:51 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-02-08 16:50 - 2014-02-08 16:51 - 00000000 ____D () C:\Program Files (x86)\Re-markit
2014-02-08 16:50 - 2014-02-08 16:50 - 00002980 _____ () C:\WINDOWS\System32\Tasks\Re-markit_wd
2014-02-08 16:50 - 2014-02-08 16:50 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-02-08 16:48 - 2014-02-08 21:10 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\DVDVideoSoft
2014-02-08 15:58 - 2014-02-08 15:58 - 00000000 ____D () C:\Users\Stefan\Documents\StreamTransport
2014-02-08 15:55 - 2014-02-08 16:09 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-02-08 11:50 - 2014-02-08 11:50 - 00000000 ____D () C:\Users\Stefan\Documents\Prüfungen_Mathe
2014-01-27 20:12 - 2014-01-27 20:12 - 00000211 _____ () C:\Users\Stefan\Downloads\formel editor.txt
2014-01-26 13:52 - 2014-02-05 16:09 - 00071066 _____ () C:\Users\Stefan\AppData\Local\Temp_table.xml
2014-01-21 15:23 - 2014-01-23 22:14 - 00000000 ____D () C:\Users\Stefan\Desktop\Yoda STL
2014-01-21 10:33 - 2014-01-21 10:33 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\PDF Architect
2014-01-20 21:26 - 2014-01-20 21:26 - 00002274 _____ () C:\Users\Public\Desktop\SolidWorks Composer Player.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00002204 _____ () C:\Users\Public\Desktop\SolidWorks Composer.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00001222 _____ () C:\Users\Public\Desktop\3DVIA Sync.lnk
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\WINDOWS\SysWOW64\Adobe
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\Users\Stefan\Documents\SolidWorksComposer
2014-01-20 11:11 - 2014-01-20 11:11 - 00000000 ____D () C:\Users\Stefan\Desktop\DS SolidWorks Composer
2014-01-19 22:11 - 2014-01-19 22:12 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Users\Stefan\Documents\PDF Architect Files
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Program Files (x86)\PDF Architect
2014-01-19 22:11 - 2013-04-09 14:13 - 00110264 _____ (pdfforge GmbH) C:\WINDOWS\system32\pdfcmon.dll
2014-01-19 22:11 - 2012-05-05 10:54 - 00137000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMAPI32.OCX
2014-01-19 22:11 - 2012-05-05 10:54 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPIDE.DLL
2014-01-19 22:11 - 1998-07-06 17:55 - 00158208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSCMCDE.DLL
2014-01-19 22:11 - 1998-07-06 17:55 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSCC2DE.DLL
2014-01-19 22:10 - 2014-01-19 22:17 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-01-19 22:01 - 2014-01-21 12:17 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Google
2014-01-19 22:00 - 2014-02-09 10:48 - 00000000 ____D () C:\Program Files\Google
2014-01-19 22:00 - 2014-02-09 09:10 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-19 22:00 - 2014-02-09 09:02 - 00000000 ____D () C:\ProgramData\Google
2014-01-19 22:00 - 2014-01-19 22:05 - 00004108 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-19 21:59 - 2014-02-09 10:48 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-19 21:59 - 2014-02-09 10:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-19 21:59 - 2014-02-09 09:02 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Google
2014-01-19 21:59 - 2014-01-19 22:05 - 00003872 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-19 21:59 - 2014-01-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-19 21:58 - 2014-01-19 22:30 - 00000000 ____D () C:\ProgramData\Adobe
2014-01-19 21:50 - 2014-01-19 21:50 - 00000000 ____D () C:\Program Files\7-Zip
2014-01-19 20:41 - 2014-01-19 20:41 - 00000517 _____ () C:\WINDOWS\SynInst.log
2014-01-19 20:41 - 2014-01-19 20:41 - 00000000 ____D () C:\ProgramData\Synaptics
2014-01-19 20:31 - 2014-01-19 22:03 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Adobe
2014-01-19 20:31 - 2014-01-19 20:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-01-19 20:30 - 2014-02-08 22:33 - 00000000 ____D () C:\Program Files (x86)\Mobogenie
2014-01-19 20:30 - 2014-02-08 19:55 - 00000000 ____D () C:\Users\Stefan\AppData\Local\genienext
2014-01-19 20:30 - 2014-01-19 20:35 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mobogenie
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\Documents\Mobogenie
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\cache
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\.android
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 _____ () C:\Users\Stefan\daemonprocess.txt
2014-01-15 21:15 - 2014-01-15 21:15 - 00170496 _____ () C:\Users\Stefan\K0698_1463.sldprt
2014-01-15 21:09 - 2014-01-15 21:09 - 00007980 _____ () C:\Users\Stefan\Downloads\PARTserver68004263.zip
2014-01-15 20:43 - 2013-12-09 01:15 - 00787968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-01-15 20:43 - 2013-11-27 16:36 - 03395920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2014-01-15 20:43 - 2013-11-27 12:41 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
2014-01-15 20:43 - 2013-11-27 11:34 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll
2014-01-15 20:43 - 2013-11-27 10:54 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-01-15 20:43 - 2013-11-27 09:48 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 20:43 - 2013-11-27 09:45 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-01-15 20:43 - 2013-11-27 09:40 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 20:43 - 2013-11-27 09:38 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-01-15 20:43 - 2013-11-27 09:17 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-01-15 20:43 - 2013-11-27 09:12 - 00848384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

==================== One Month Modified Files and Folders =======

2014-02-09 11:04 - 2014-02-09 11:03 - 00000000 ____D () C:\FRST
2014-02-09 11:02 - 2013-12-06 21:09 - 01955525 _____ () C:\WINDOWS\WindowsUpdate.log
2014-02-09 11:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-02-09 10:55 - 2013-12-07 05:51 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2014-02-09 10:55 - 2013-12-07 05:51 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2014-02-09 10:55 - 2013-10-07 19:27 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-02-09 10:53 - 2013-12-28 19:41 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3974548523-2819813499-3364971708-1002
2014-02-09 10:49 - 2014-02-09 10:44 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Avg2014
2014-02-09 10:48 - 2014-02-08 16:50 - 00000398 _____ () C:\WINDOWS\Tasks\Re-markit_wd.job
2014-02-09 10:48 - 2014-01-19 22:00 - 00000000 ____D () C:\Program Files\Google
2014-02-09 10:48 - 2014-01-19 21:59 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-09 10:48 - 2014-01-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-09 10:48 - 2013-12-28 19:38 - 00000000 __RDO () C:\Users\Stefan\SkyDrive
2014-02-09 10:48 - 2013-10-07 19:23 - 00058738 _____ () C:\WINDOWS\PFRO.log
2014-02-09 10:48 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-02-09 10:47 - 2013-12-06 21:41 - 00004608 _____ () C:\WINDOWS\system32\VfService.trf
2014-02-09 10:47 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-02-09 10:47 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-02-09 10:46 - 2014-02-09 10:44 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-09 10:45 - 2014-02-09 10:45 - 00001008 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-02-09 10:45 - 2014-02-09 10:45 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\AVG2014
2014-02-09 10:45 - 2014-02-09 10:44 - 00000000 ____D () C:\ProgramData\AVG2014
2014-02-09 10:45 - 2014-02-08 16:50 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\TuneUp Software
2014-02-09 10:45 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ___HD () C:\$AVG
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Users\Stefan\AppData\Local\MFAData
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-02-09 10:41 - 2014-02-09 10:41 - 00123424 _____ () C:\Users\Stefan\Desktop\Lollipop Network, S_L_ - Trojaner-Board.htm
2014-02-09 10:41 - 2014-02-09 10:41 - 00000000 ____D () C:\Users\Stefan\Desktop\Lollipop Network, S_L_ - Trojaner-Board-Dateien
2014-02-09 10:34 - 2013-12-28 20:09 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{F2E2BF5B-4C2A-4C14-BC93-6874176530BF}
2014-02-09 09:10 - 2014-01-19 22:00 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-09 09:05 - 2014-02-09 09:05 - 00000000 ____D () C:\Users\Stefan\Desktop\Log_File
2014-02-09 09:02 - 2014-01-19 22:00 - 00000000 ____D () C:\ProgramData\Google
2014-02-09 09:02 - 2014-01-19 21:59 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Google
2014-02-08 22:33 - 2014-01-19 20:30 - 00000000 ____D () C:\Program Files (x86)\Mobogenie
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\ProgramData\Mozilla
2014-02-08 21:36 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-02-08 21:17 - 2014-02-08 21:17 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-02-08 21:10 - 2014-02-08 16:48 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\DVDVideoSoft
2014-02-08 21:10 - 2013-12-06 21:12 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-08 20:05 - 2014-02-08 19:29 - 00000000 ____D () C:\AdwCleaner
2014-02-08 19:58 - 2013-12-28 19:35 - 00000000 ___RD () C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 19:55 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\genienext
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Malwarebytes
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 19:30 - 2014-01-01 19:09 - 00000000 ____D () C:\Users\Stefan\AppData\Local\CrashDumps
2014-02-08 16:52 - 2014-02-08 16:52 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\VOPackage
2014-02-08 16:51 - 2014-02-08 16:50 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-02-08 16:51 - 2014-02-08 16:50 - 00000000 ____D () C:\Program Files (x86)\Re-markit
2014-02-08 16:50 - 2014-02-08 16:50 - 00002980 _____ () C:\WINDOWS\System32\Tasks\Re-markit_wd
2014-02-08 16:50 - 2014-02-08 16:50 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-02-08 16:09 - 2014-02-08 15:55 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-02-08 15:58 - 2014-02-08 15:58 - 00000000 ____D () C:\Users\Stefan\Documents\StreamTransport
2014-02-08 11:51 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-02-08 11:50 - 2014-02-08 11:50 - 00000000 ____D () C:\Users\Stefan\Documents\Prüfungen_Mathe
2014-02-08 11:19 - 2013-12-29 16:01 - 00000000 ____D () C:\Users\Stefan\Desktop\Schule
2014-02-08 10:25 - 2013-12-29 10:40 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Microsoft Help
2014-02-07 20:18 - 2013-12-28 19:36 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Atheros
2014-02-07 11:20 - 2013-12-28 19:36 - 00000000 ____D () C:\Users\Stefan\Documents\Bluetooth Folder
2014-02-05 16:09 - 2014-01-26 13:52 - 00071066 _____ () C:\Users\Stefan\AppData\Local\Temp_table.xml
2014-02-05 15:50 - 2013-12-29 10:36 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\SolidWorks
2014-02-05 10:37 - 2013-12-29 10:40 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-03 15:03 - 2013-12-29 15:59 - 00000000 ____D () C:\Users\Stefan\AppData\Local\RepetierHost
2014-01-31 11:58 - 2013-12-28 19:35 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Packages
2014-01-30 21:47 - 2013-08-22 16:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-01-30 21:47 - 2013-08-22 16:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-27 20:12 - 2014-01-27 20:12 - 00000211 _____ () C:\Users\Stefan\Downloads\formel editor.txt
2014-01-23 22:14 - 2014-01-21 15:23 - 00000000 ____D () C:\Users\Stefan\Desktop\Yoda STL
2014-01-22 21:08 - 2014-01-04 17:00 - 00000000 ____D () C:\Users\Stefan\Desktop\Für Schüler CD
2014-01-21 15:22 - 2013-08-22 15:46 - 00024396 _____ () C:\WINDOWS\setupact.log
2014-01-21 12:17 - 2014-01-19 22:01 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Google
2014-01-21 10:33 - 2014-01-21 10:33 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\PDF Architect
2014-01-20 21:26 - 2014-01-20 21:26 - 00002274 _____ () C:\Users\Public\Desktop\SolidWorks Composer Player.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00002204 _____ () C:\Users\Public\Desktop\SolidWorks Composer.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00001222 _____ () C:\Users\Public\Desktop\3DVIA Sync.lnk
2014-01-20 20:20 - 2013-12-29 10:57 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\WINDOWS\SysWOW64\Adobe
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\Users\Stefan\Documents\SolidWorksComposer
2014-01-20 11:16 - 2013-12-29 10:41 - 00000000 ____D () C:\Program Files\SolidWorks Corp
2014-01-20 11:11 - 2014-01-20 11:11 - 00000000 ____D () C:\Users\Stefan\Desktop\DS SolidWorks Composer
2014-01-19 22:48 - 2013-12-28 19:35 - 00000000 ____D () C:\Users\Stefan
2014-01-19 22:30 - 2014-01-19 21:58 - 00000000 ____D () C:\ProgramData\Adobe
2014-01-19 22:17 - 2014-01-19 22:10 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-01-19 22:12 - 2014-01-19 22:11 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Users\Stefan\Documents\PDF Architect Files
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Program Files (x86)\PDF Architect
2014-01-19 22:05 - 2014-01-19 22:00 - 00004108 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-19 22:05 - 2014-01-19 21:59 - 00003872 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-19 22:03 - 2014-01-19 20:31 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Adobe
2014-01-19 22:03 - 2013-12-28 19:35 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Adobe
2014-01-19 21:59 - 2014-01-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-19 21:50 - 2014-01-19 21:50 - 00000000 ____D () C:\Program Files\7-Zip
2014-01-19 20:41 - 2014-01-19 20:41 - 00000517 _____ () C:\WINDOWS\SynInst.log
2014-01-19 20:41 - 2014-01-19 20:41 - 00000000 ____D () C:\ProgramData\Synaptics
2014-01-19 20:35 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mobogenie
2014-01-19 20:31 - 2014-01-19 20:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\Documents\Mobogenie
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\cache
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\.android
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 _____ () C:\Users\Stefan\daemonprocess.txt
2014-01-19 17:32 - 2013-12-29 16:20 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Nitro PDF
2014-01-19 08:38 - 2014-02-08 22:53 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-01-16 18:19 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-01-16 09:37 - 2014-01-01 15:17 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-01-16 09:36 - 2014-01-01 15:17 - 86054176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-01-15 21:15 - 2014-01-15 21:15 - 00170496 _____ () C:\Users\Stefan\K0698_1463.sldprt
2014-01-15 21:09 - 2014-01-15 21:09 - 00007980 _____ () C:\Users\Stefan\Downloads\PARTserver68004263.zip

Some content of TEMP:
====================
C:\Users\Stefan\AppData\Local\Temp\avgnt.exe
C:\Users\Stefan\AppData\Local\Temp\BackupSetup.exe
C:\Users\Stefan\AppData\Local\Temp\ose00000.exe
C:\Users\Stefan\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 20:49

==================== End Of Log ============================
Addition

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2014
Ran by Stefan at 2014-02-09 11:04:44
Running from C:\Users\Stefan\AppData\Local\Microsoft\Windows\INetCache\IE\2FKGMS6E
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Adobe SVG Viewer 3.0 (x32 Version:  3.0 - )
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
Arduino (x32 Version: 1.0.5 - Arduino LLC)
AVG 2014 (Version: 14.0.3697 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4335 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4335 - AVG Technologies)
Avira SearchFree Toolbar (x32 Version: 12.10.0.2951 - APN, LLC)
Benutzerhandbuch (x32 Version: 1.0.0.15 - Lenovo) Hidden
CyberLink PhotoDirector 3 (x32 Version: 3.0.1.4107 - CyberLink Corp.)
CyberLink PhotoDirector 3 (x32 Version: 3.0.1.4107 - CyberLink Corp.) Hidden
DMUninstaller (x32 Version:  - ) <==== ATTENTION
Dolby Digital Plus Home Theater (Version: 7.3.2.2 - Dolby Laboratories Inc)
Energy Manager (x32 Version: 1.0.0.31 - Lenovo)
Energy Manager (x32 Version: 1.0.0.31 - Lenovo) Hidden
Git version 1.8.4-preview20130916 (x32 Version: 1.8.4-preview20130916 - The Git Development Community)
Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
IDT Audio (x32 Version: 1.0.6490.0 - IDT)
Intel Collaborative Processor Performance Control (x32 Version: 1.0.0.1013 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 10.18.10.3316 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.8.5.1000 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.8.5.1000 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden
Lenovo App Shop (x32 Version: 3.10.0.45246.24 - Lenovo)
Lenovo EasyCamera (x32 Version: 6.2.9200.10245 - Realtek Semiconductor Corp.)
Lenovo Experience Improvement (Version: 1.0.4.0 - Lenovo)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo OneKey Recovery (x32 Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo Photos (x32 Version: 4.8.7 - CEWE COLOR AG u Co. OHG)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
Lenovo VeriFace (Version: 5.0.13.5261 - Lenovo)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Silverlight (x32 Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version:  - Microsoft Corporation)
Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (Version: 8.0.52572 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version:  - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Applications - ENU (x32 Version: 8.0.50727.146 - Microsoft Corporation) Hidden
NVIDIA GeForce Experience 1.6.1 (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 327.02 (Version: 327.02 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.133.902 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA Systemsteuerung 327.02 (Version: 327.02 - NVIDIA Corporation) Hidden
NVIDIA Update 8.3.14 (Version: 8.3.14 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 8.3.14 - NVIDIA Corporation) Hidden
Onekey Theater (x32 Version: 3.0.1.2 - Lenovo)
PARTcommunity 3D Web Viewer (x32 Version: 9.04.0 - CADENAS GmbH)
PDF Architect (x32 Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (x32 Version: 1.7.2 - pdfforge)
Power2Go (x32 Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros Client Installation Program (x32 Version: 10.0 - Qualcomm Atheros)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Re-markit (x32 Version:  - Re-markit Software) <==== ATTENTION
Repetier-Host Version 0.95 (Version: 0.95 - repetier)
SolidWorks 2011 x64 Edition SP0 (Version: 19.100.5019 - SolidWorks) Hidden
SolidWorks 2011 x64 Edition SP0 (x32 Version: 19.0.0.5019 - SolidWorks Corporation)
SolidWorks 2011 x64 German Resources (Version: 19.100.5019 - SolidWorks Corporation) Hidden
SolidWorks Composer 2013 SP2 x64 Edition (Version: 6.11.2.2291 - Dassault Systemes)
SolidWorks eDrawings 2011 x64 Edition SP0 (Version: 11.0.720 - Dassault Systèmes SolidWorks Corp.) Hidden
SolidWorks Explorer 2011 SP0 x64 Edition (Version: 19.00.5019 - SolidWorks Corporation) Hidden
StageLight (Version: 1.1.0.4070 - Open Labs, LLC.)
UserGuide (x32 Version: 1.0.0.15 - Lenovo)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VO Package (x32 Version: 1.0.0.0 - )
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.776) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (Version: 07/25/2013 10.30.0.288 - Lenovo)

==================== Restore Points  =========================

08-02-2014 15:55:40 TuneUp Utilities 2014 wird entfernt

==================== Hosts content: ==========================

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {49DD4968-06BD-46FA-B0D5-639B5C14DC03} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-01-16] (Microsoft Corporation)
Task: {5764FA36-FACD-4890-A362-D30043C3D372} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {B5CF79FD-7DC5-482D-844B-5B479D8BB973} - System32\Tasks\Re-markit_wd => C:\Program Files (x86)\Re-markit\Re-markit_wd.exe [2014-02-08] () <==== ATTENTION
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D4A01699-A641-49A2-824D-87B89BFF5EB6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-19] (Google Inc.)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DAF6A3F3-A457-4BA3-A5C2-B0BA2A9BF9FB} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-06-03] (Lenovo)
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {F12E7CBC-E0CF-4D71-B1BC-752DDAE01DA9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-19] (Google Inc.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Re-markit_wd.job => C:\Program Files (x86)\Re-markit\Re-markit_wd.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2013-09-07 01:48 - 2013-09-07 01:48 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-09-07 01:45 - 2013-09-07 01:45 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll
2013-12-06 21:12 - 2013-09-04 00:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Stefan\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Faulty Device Manager Devices =============

Name: Von Microsoft gehosteter, virtueller Netzwerkadapter
Description: Von Microsoft gehosteter, virtueller Netzwerkadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/08/2014 11:29:02 PM) (Source: .NET Runtime) (User: )
Description: Anwendung: IAStorIcon.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:

Server stack trace: 
   bei System.ServiceModel.Channels.CommunicationObject.ThrowIfDisposedOrNotOpen()
   bei System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
   bei System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
   bei System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
   bei System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(System.Runtime.Remoting.Messaging.IMessage, System.Runtime.Remoting.Messaging.IMessage)
   bei System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(System.Runtime.Remoting.Proxies.MessageData ByRef, Int32)
   bei IAStorDataMgrSvcInterfaces.IPublisher.GetServerBit()
   bei IAStorIcon.StorageIcon.<trySubscription>b__0(System.Object)
   bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   bei System.Threading.ThreadPoolWorkQueue.Dispatch()
   bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()

Error: (02/08/2014 07:47:17 PM) (Source: Perflib) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (02/08/2014 07:29:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16384, Zeitstempel: 0x52157231
Name des fehlerhaften Moduls: jscript9.dll, Version: 11.0.9600.16476, Zeitstempel: 0x5294589a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00008a95
ID des fehlerhaften Prozesses: 0x73d4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Vollständiger Name des fehlerhaften Pakets: IEXPLORE.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IEXPLORE.EXE5

Error: (02/08/2014 04:05:41 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.

Error: (02/08/2014 04:05:39 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.

Error: (02/08/2014 04:05:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.

Error: (02/08/2014 03:51:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.

Error: (02/08/2014 03:51:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.

Error: (02/08/2014 03:51:32 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.

Error: (02/08/2014 03:51:32 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_a9f4965301334e09.manifest.


System errors:
=============
Error: (02/09/2014 10:48:30 AM) (Source: ipnathlp) (User: )
Description: 

Error: (02/09/2014 10:48:30 AM) (Source: ipnathlp) (User: )
Description: 

Error: (02/09/2014 10:28:41 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (02/09/2014 10:28:41 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (02/09/2014 08:57:49 AM) (Source: ipnathlp) (User: )
Description: 

Error: (02/09/2014 08:57:49 AM) (Source: ipnathlp) (User: )
Description: 

Error: (02/09/2014 08:57:37 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst MBAMService erreicht.

Error: (02/08/2014 10:42:49 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (02/08/2014 10:42:34 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (02/08/2014 10:42:34 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 16308.27 MB
Available physical RAM: 12840.27 MB
Total Pagefile: 18740.27 MB
Available Pagefile: 15965.13 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:891.84 GB) (Free:828.95 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: B6D1C74B)

Partition: GPT Partition Type
==================== End Of Log ============================
Vielen Dank schon mal im Voraus.
Grüße

Alt 09.02.2014, 11:49   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Lollipop Network S.L. und weitere - Standard

Lollipop Network S.L. und weitere


hi,

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________

__________________
Alt 09.02.2014, 12:44   #3
petermuelle
 
Lollipop Network S.L. und weitere - Standard

Lollipop Network S.L. und weitere


MalwareBytes

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.02.09.02

Windows 8 x64 NTFS
Internet Explorer 11.0.9600.16476
Stefan :: PC_HAEMMISCH [Administrator]

Schutz: Deaktiviert

09.02.2014 12:19:09
mbam-log-2014-02-09 (12-19-09).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 242989
Laufzeit: 4 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
AdwCleaner

Code:
ATTFilter
# AdwCleaner v3.018 - Bericht erstellt am 09/02/2014 um 12:25:47
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Stefan - PC_HAEMMISCH
# Gestartet von : C:\Users\Stefan\AppData\Local\Microsoft\Windows\INetCache\IE\MD634CKV\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : APNMCP

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\apn

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\AskPartnerNetwork
Schlüssel Gelöscht : HKLM\Software\AskPartnerNetwork
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\AskPartnerNetwork

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16384


-\\ Mozilla Firefox v

[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\agqdruib.default\prefs.js ]


-\\ Google Chrome v32.0.1700.107

[ Datei : C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [4473 octets] - [08/02/2014 20:02:05]
AdwCleaner[R1].txt - [1717 octets] - [09/02/2014 12:24:24]
AdwCleaner[S0].txt - [3976 octets] - [08/02/2014 20:05:32]
AdwCleaner[S1].txt - [1582 octets] - [09/02/2014 12:25:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1642 octets] ##########
FRST


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-02-2014
Ran by Stefan (administrator) on PC_HAEMMISCH on 09-02-2014 12:36:40
Running from C:\Users\Stefan\AppData\Local\Microsoft\Windows\INetCache\IE\HZIWH0PD
Windows 8.1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Program Files (x86)\Re-markit\Re-markit153.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Microsoft Corporation) C:\WINDOWS\System32\alg.exe
() C:\Program Files (x86)\Re-markit\Re-markit_wd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Windows\System32\skydrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Lenovo) C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [RtsFT] - C:\WINDOWS\RTFTrack.exe [6340312 2013-09-02] (Realtek semiconductor)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [OnekeyStudio] - C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-09-14] (Lenovo)
HKLM\...\Run: [Energy Manager] - C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2013-12-06] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] - C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2013-12-06] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [Lenovo App Shop] - C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [179976 2013-08-26] (cyberlink)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4962320 2014-01-22] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] ( (Atheros Communications))
HKU\S-1-5-21-3974548523-2819813499-3364971708-1002\...\MountPoints2: {7e444ef5-7851-11e3-825e-40f02f5e2160} - "F:\HTC_Sync_Manager_PC.exe" 

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:13828
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {178B6BD3-D755-47F4-A214-375FE29BB332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=LCJB
SearchScopes: HKLM-x32 - {178B6BD3-D755-47F4-A214-375FE29BB332} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=LCJB
SearchScopes: HKCU - {178B6BD3-D755-47F4-A214-375FE29BB332} URL = 
BHO: Plus-HD-7.5 - {11111111-1111-1111-1111-110511071176} - C:\Program Files (x86)\Plus-HD-7.5\Plus-HD-7.5-bho64.dll No File
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" No File
BHO-x32: No Name - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} -  No File
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" No File
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM-x32 {12545791-AC9A-44B2-8964-0DA216C4A4E5} hxxp://kipp.partcommunity.com/FileService/FileLoader/cnsViewer3D/pwebdownloader.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\agqdruib.default
FF Plugin: @cadenas.de/PARTwebViewer - C:\Program Files (x86)\cadenas\partwebviewer\bin\x86\64\npwebviewerplugins.dll (CADENAS GmbH)
FF Plugin-x32: @cadenas.de/PARTwebViewer - C:\Program Files (x86)\cadenas\partwebviewer\bin\x86\32\npwebviewerplugins.dll (CADENAS GmbH)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: intel.com/AppUp - C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp.dll (Intel)
FF Plugin HKCU: intel.com/AppUpx64 - C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll (Intel)
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2014-01-19]

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-19]
CHR Extension: (Google Drive) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-19]
CHR Extension: (YouTube) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-19]
CHR Extension: (Google Search) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-19]
CHR Extension: (Google Wallet) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-19]
CHR Extension: (Gmail) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-19]

==================== Services (Whitelisted) =================

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3788816 2014-01-22] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
S2 CLKMSVC10_3A60B698; C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe [243464 2013-08-26] (CyberLink)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Re-markit; C:\Program Files (x86)\Re-markit\Re-markit153.exe [180736 2014-02-08] ()
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2013-12-06] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-09-07] (Atheros)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [252728 2013-10-21] (AVG Technologies CZ, s.r.o.)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-07] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8874712 2013-09-02] (Realtek Semiconductor Corp.)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 SmbDrvI; \SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-09 12:33 - 2014-02-09 12:33 - 00001791 _____ () C:\Users\Stefan\Desktop\JRT.txt
2014-02-09 12:17 - 2014-02-09 12:17 - 00001136 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-09 12:17 - 2014-02-09 12:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-09 12:17 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-02-09 11:19 - 2014-02-09 11:19 - 00000000 _____ () C:\Users\Stefan\defogger_reenable
2014-02-09 11:03 - 2014-02-09 12:36 - 00000000 ____D () C:\FRST
2014-02-09 10:45 - 2014-02-09 10:45 - 00001008 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-02-09 10:45 - 2014-02-09 10:45 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\AVG2014
2014-02-09 10:44 - 2014-02-09 10:49 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Avg2014
2014-02-09 10:44 - 2014-02-09 10:46 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-09 10:44 - 2014-02-09 10:45 - 00000000 ____D () C:\ProgramData\AVG2014
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ___HD () C:\$AVG
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Users\Stefan\AppData\Local\MFAData
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-02-09 09:05 - 2014-02-09 12:22 - 00000000 ____D () C:\Users\Stefan\Desktop\Log_File
2014-02-08 22:53 - 2014-01-19 08:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\ProgramData\Mozilla
2014-02-08 21:17 - 2014-02-08 21:17 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Malwarebytes
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 19:29 - 2014-02-09 12:25 - 00000000 ____D () C:\AdwCleaner
2014-02-08 16:52 - 2014-02-08 16:52 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\VOPackage
2014-02-08 16:50 - 2014-02-09 12:27 - 00000398 _____ () C:\WINDOWS\Tasks\Re-markit_wd.job
2014-02-08 16:50 - 2014-02-09 10:45 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\TuneUp Software
2014-02-08 16:50 - 2014-02-08 16:51 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-02-08 16:50 - 2014-02-08 16:51 - 00000000 ____D () C:\Program Files (x86)\Re-markit
2014-02-08 16:50 - 2014-02-08 16:50 - 00002980 _____ () C:\WINDOWS\System32\Tasks\Re-markit_wd
2014-02-08 16:50 - 2014-02-08 16:50 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-02-08 16:48 - 2014-02-08 21:10 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\DVDVideoSoft
2014-02-08 15:58 - 2014-02-08 15:58 - 00000000 ____D () C:\Users\Stefan\Documents\StreamTransport
2014-02-08 15:55 - 2014-02-08 16:09 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-02-08 11:50 - 2014-02-08 11:50 - 00000000 ____D () C:\Users\Stefan\Documents\Prüfungen_Mathe
2014-01-27 20:12 - 2014-01-27 20:12 - 00000211 _____ () C:\Users\Stefan\Downloads\formel editor.txt
2014-01-26 13:52 - 2014-02-05 16:09 - 00071066 _____ () C:\Users\Stefan\AppData\Local\Temp_table.xml
2014-01-21 15:23 - 2014-01-23 22:14 - 00000000 ____D () C:\Users\Stefan\Desktop\Yoda STL
2014-01-21 10:33 - 2014-01-21 10:33 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\PDF Architect
2014-01-20 21:26 - 2014-01-20 21:26 - 00002274 _____ () C:\Users\Public\Desktop\SolidWorks Composer Player.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00002204 _____ () C:\Users\Public\Desktop\SolidWorks Composer.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00001222 _____ () C:\Users\Public\Desktop\3DVIA Sync.lnk
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\WINDOWS\SysWOW64\Adobe
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\Users\Stefan\Documents\SolidWorksComposer
2014-01-20 11:11 - 2014-01-20 11:11 - 00000000 ____D () C:\Users\Stefan\Desktop\DS SolidWorks Composer
2014-01-19 22:11 - 2014-01-19 22:12 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Users\Stefan\Documents\PDF Architect Files
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Program Files (x86)\PDF Architect
2014-01-19 22:11 - 2013-04-09 14:13 - 00110264 _____ (pdfforge GmbH) C:\WINDOWS\system32\pdfcmon.dll
2014-01-19 22:11 - 2012-05-05 10:54 - 00137000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMAPI32.OCX
2014-01-19 22:11 - 2012-05-05 10:54 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPIDE.DLL
2014-01-19 22:11 - 1998-07-06 17:55 - 00158208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSCMCDE.DLL
2014-01-19 22:11 - 1998-07-06 17:55 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSCC2DE.DLL
2014-01-19 22:10 - 2014-01-19 22:17 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-01-19 22:01 - 2014-01-21 12:17 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Google
2014-01-19 22:00 - 2014-02-09 11:10 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-19 22:00 - 2014-02-09 10:48 - 00000000 ____D () C:\Program Files\Google
2014-01-19 22:00 - 2014-02-09 09:02 - 00000000 ____D () C:\ProgramData\Google
2014-01-19 22:00 - 2014-01-19 22:05 - 00004108 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-19 21:59 - 2014-02-09 12:27 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-19 21:59 - 2014-02-09 10:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-19 21:59 - 2014-02-09 09:02 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Google
2014-01-19 21:59 - 2014-01-19 22:05 - 00003872 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-19 21:59 - 2014-01-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-19 21:58 - 2014-01-19 22:30 - 00000000 ____D () C:\ProgramData\Adobe
2014-01-19 21:50 - 2014-01-19 21:50 - 00000000 ____D () C:\Program Files\7-Zip
2014-01-19 20:41 - 2014-01-19 20:41 - 00000517 _____ () C:\WINDOWS\SynInst.log
2014-01-19 20:41 - 2014-01-19 20:41 - 00000000 ____D () C:\ProgramData\Synaptics
2014-01-19 20:31 - 2014-01-19 22:03 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Adobe
2014-01-19 20:31 - 2014-01-19 20:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-01-19 20:30 - 2014-02-08 22:33 - 00000000 ____D () C:\Program Files (x86)\Mobogenie
2014-01-19 20:30 - 2014-02-08 19:55 - 00000000 ____D () C:\Users\Stefan\AppData\Local\genienext
2014-01-19 20:30 - 2014-01-19 20:35 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mobogenie
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\Documents\Mobogenie
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\cache
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\.android
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 _____ () C:\Users\Stefan\daemonprocess.txt
2014-01-15 21:15 - 2014-01-15 21:15 - 00170496 _____ () C:\Users\Stefan\K0698_1463.sldprt
2014-01-15 21:09 - 2014-01-15 21:09 - 00007980 _____ () C:\Users\Stefan\Downloads\PARTserver68004263.zip
2014-01-15 20:43 - 2013-12-09 01:15 - 00787968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-01-15 20:43 - 2013-11-27 16:36 - 03395920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2014-01-15 20:43 - 2013-11-27 12:41 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
2014-01-15 20:43 - 2013-11-27 11:34 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll
2014-01-15 20:43 - 2013-11-27 10:54 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-01-15 20:43 - 2013-11-27 09:48 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 20:43 - 2013-11-27 09:45 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-01-15 20:43 - 2013-11-27 09:40 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 20:43 - 2013-11-27 09:38 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-01-15 20:43 - 2013-11-27 09:17 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-01-15 20:43 - 2013-11-27 09:12 - 00848384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

==================== One Month Modified Files and Folders =======

2014-02-09 12:36 - 2014-02-09 11:03 - 00000000 ____D () C:\FRST
2014-02-09 12:36 - 2013-12-28 19:41 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3974548523-2819813499-3364971708-1002
2014-02-09 12:33 - 2014-02-09 12:33 - 00001791 _____ () C:\Users\Stefan\Desktop\JRT.txt
2014-02-09 12:33 - 2013-12-07 05:51 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2014-02-09 12:33 - 2013-12-07 05:51 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2014-02-09 12:33 - 2013-10-07 19:27 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-02-09 12:27 - 2014-02-08 16:50 - 00000398 _____ () C:\WINDOWS\Tasks\Re-markit_wd.job
2014-02-09 12:27 - 2014-01-19 21:59 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-09 12:27 - 2013-12-28 19:38 - 00000000 __RDO () C:\Users\Stefan\SkyDrive
2014-02-09 12:27 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-02-09 12:26 - 2013-12-06 21:41 - 00004608 _____ () C:\WINDOWS\system32\VfService.trf
2014-02-09 12:26 - 2013-12-06 21:09 - 01963358 _____ () C:\WINDOWS\WindowsUpdate.log
2014-02-09 12:26 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-02-09 12:25 - 2014-02-08 19:29 - 00000000 ____D () C:\AdwCleaner
2014-02-09 12:22 - 2014-02-09 09:05 - 00000000 ____D () C:\Users\Stefan\Desktop\Log_File
2014-02-09 12:17 - 2014-02-09 12:17 - 00001136 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-09 12:17 - 2014-02-09 12:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-09 11:30 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-02-09 11:29 - 2013-12-29 10:36 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\SolidWorks
2014-02-09 11:19 - 2014-02-09 11:19 - 00000000 _____ () C:\Users\Stefan\defogger_reenable
2014-02-09 11:19 - 2013-12-28 19:35 - 00000000 ____D () C:\Users\Stefan
2014-02-09 11:10 - 2014-01-19 22:00 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-09 11:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-02-09 10:49 - 2014-02-09 10:44 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Avg2014
2014-02-09 10:48 - 2014-01-19 22:00 - 00000000 ____D () C:\Program Files\Google
2014-02-09 10:48 - 2014-01-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-09 10:48 - 2013-10-07 19:23 - 00058738 _____ () C:\WINDOWS\PFRO.log
2014-02-09 10:47 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-02-09 10:46 - 2014-02-09 10:44 - 00000000 ____D () C:\ProgramData\MFAData
2014-02-09 10:45 - 2014-02-09 10:45 - 00001008 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-02-09 10:45 - 2014-02-09 10:45 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\AVG2014
2014-02-09 10:45 - 2014-02-09 10:44 - 00000000 ____D () C:\ProgramData\AVG2014
2014-02-09 10:45 - 2014-02-08 16:50 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\TuneUp Software
2014-02-09 10:45 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ___HD () C:\$AVG
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Users\Stefan\AppData\Local\MFAData
2014-02-09 10:44 - 2014-02-09 10:44 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-02-09 10:34 - 2013-12-28 20:09 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{F2E2BF5B-4C2A-4C14-BC93-6874176530BF}
2014-02-09 09:02 - 2014-01-19 22:00 - 00000000 ____D () C:\ProgramData\Google
2014-02-09 09:02 - 2014-01-19 21:59 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Google
2014-02-08 22:33 - 2014-01-19 20:30 - 00000000 ____D () C:\Program Files (x86)\Mobogenie
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mozilla
2014-02-08 21:40 - 2014-02-08 21:40 - 00000000 ____D () C:\ProgramData\Mozilla
2014-02-08 21:17 - 2014-02-08 21:17 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-02-08 21:10 - 2014-02-08 16:48 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\DVDVideoSoft
2014-02-08 21:10 - 2013-12-06 21:12 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-08 19:58 - 2013-12-28 19:35 - 00000000 ___RD () C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-08 19:55 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\genienext
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Malwarebytes
2014-02-08 19:32 - 2014-02-08 19:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-08 19:30 - 2014-01-01 19:09 - 00000000 ____D () C:\Users\Stefan\AppData\Local\CrashDumps
2014-02-08 16:52 - 2014-02-08 16:52 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\VOPackage
2014-02-08 16:51 - 2014-02-08 16:50 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-02-08 16:51 - 2014-02-08 16:50 - 00000000 ____D () C:\Program Files (x86)\Re-markit
2014-02-08 16:50 - 2014-02-08 16:50 - 00002980 _____ () C:\WINDOWS\System32\Tasks\Re-markit_wd
2014-02-08 16:50 - 2014-02-08 16:50 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-02-08 16:09 - 2014-02-08 15:55 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-02-08 15:58 - 2014-02-08 15:58 - 00000000 ____D () C:\Users\Stefan\Documents\StreamTransport
2014-02-08 11:51 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-02-08 11:50 - 2014-02-08 11:50 - 00000000 ____D () C:\Users\Stefan\Documents\Prüfungen_Mathe
2014-02-08 11:19 - 2013-12-29 16:01 - 00000000 ____D () C:\Users\Stefan\Desktop\Schule
2014-02-08 10:25 - 2013-12-29 10:40 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Microsoft Help
2014-02-07 20:18 - 2013-12-28 19:36 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Atheros
2014-02-07 11:20 - 2013-12-28 19:36 - 00000000 ____D () C:\Users\Stefan\Documents\Bluetooth Folder
2014-02-05 16:09 - 2014-01-26 13:52 - 00071066 _____ () C:\Users\Stefan\AppData\Local\Temp_table.xml
2014-02-05 10:37 - 2013-12-29 10:40 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-03 15:03 - 2013-12-29 15:59 - 00000000 ____D () C:\Users\Stefan\AppData\Local\RepetierHost
2014-01-31 11:58 - 2013-12-28 19:35 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Packages
2014-01-30 21:47 - 2013-08-22 16:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-01-30 21:47 - 2013-08-22 16:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-27 20:12 - 2014-01-27 20:12 - 00000211 _____ () C:\Users\Stefan\Downloads\formel editor.txt
2014-01-23 22:14 - 2014-01-21 15:23 - 00000000 ____D () C:\Users\Stefan\Desktop\Yoda STL
2014-01-22 21:08 - 2014-01-04 17:00 - 00000000 ____D () C:\Users\Stefan\Desktop\Für Schüler CD
2014-01-21 15:22 - 2013-08-22 15:46 - 00024396 _____ () C:\WINDOWS\setupact.log
2014-01-21 12:17 - 2014-01-19 22:01 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Google
2014-01-21 10:33 - 2014-01-21 10:33 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\PDF Architect
2014-01-20 21:26 - 2014-01-20 21:26 - 00002274 _____ () C:\Users\Public\Desktop\SolidWorks Composer Player.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00002204 _____ () C:\Users\Public\Desktop\SolidWorks Composer.lnk
2014-01-20 21:26 - 2014-01-20 21:26 - 00001222 _____ () C:\Users\Public\Desktop\3DVIA Sync.lnk
2014-01-20 20:20 - 2013-12-29 10:57 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\WINDOWS\SysWOW64\Adobe
2014-01-20 11:16 - 2014-01-20 11:16 - 00000000 ____D () C:\Users\Stefan\Documents\SolidWorksComposer
2014-01-20 11:16 - 2013-12-29 10:41 - 00000000 ____D () C:\Program Files\SolidWorks Corp
2014-01-20 11:11 - 2014-01-20 11:11 - 00000000 ____D () C:\Users\Stefan\Desktop\DS SolidWorks Composer
2014-01-19 22:30 - 2014-01-19 21:58 - 00000000 ____D () C:\ProgramData\Adobe
2014-01-19 22:17 - 2014-01-19 22:10 - 00000000 ____D () C:\Program Files (x86)\Amazon
2014-01-19 22:12 - 2014-01-19 22:11 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Users\Stefan\Documents\PDF Architect Files
2014-01-19 22:11 - 2014-01-19 22:11 - 00000000 ____D () C:\Program Files (x86)\PDF Architect
2014-01-19 22:05 - 2014-01-19 22:00 - 00004108 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-19 22:05 - 2014-01-19 21:59 - 00003872 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-19 22:03 - 2014-01-19 20:31 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Adobe
2014-01-19 22:03 - 2013-12-28 19:35 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Adobe
2014-01-19 21:59 - 2014-01-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-19 21:50 - 2014-01-19 21:50 - 00000000 ____D () C:\Program Files\7-Zip
2014-01-19 20:41 - 2014-01-19 20:41 - 00000517 _____ () C:\WINDOWS\SynInst.log
2014-01-19 20:41 - 2014-01-19 20:41 - 00000000 ____D () C:\ProgramData\Synaptics
2014-01-19 20:35 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Mobogenie
2014-01-19 20:31 - 2014-01-19 20:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\Documents\Mobogenie
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\AppData\Local\cache
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 ____D () C:\Users\Stefan\.android
2014-01-19 20:30 - 2014-01-19 20:30 - 00000000 _____ () C:\Users\Stefan\daemonprocess.txt
2014-01-19 17:32 - 2013-12-29 16:20 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Nitro PDF
2014-01-19 08:38 - 2014-02-08 22:53 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-01-16 18:19 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-01-16 09:37 - 2014-01-01 15:17 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-01-16 09:36 - 2014-01-01 15:17 - 86054176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-01-15 21:15 - 2014-01-15 21:15 - 00170496 _____ () C:\Users\Stefan\K0698_1463.sldprt
2014-01-15 21:09 - 2014-01-15 21:09 - 00007980 _____ () C:\Users\Stefan\Downloads\PARTserver68004263.zip

Some content of TEMP:
====================
C:\Users\Stefan\AppData\Local\Temp\avgnt.exe
C:\Users\Stefan\AppData\Local\Temp\BackupSetup.exe
C:\Users\Stefan\AppData\Local\Temp\ose00000.exe
C:\Users\Stefan\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 20:49

==================== End Of Log ============================
--- --- ---


JRT, sorry ich hab nichts gefunden um die .txt anzuhängen.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 8.1 x64
Ran by Stefan on 09.02.2014 at 12:29:54,18
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220522072276}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220522072276}
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{44cbc005-6243-4502-8a02-3a096a282664}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{80703783-e415-4ee3-ab60-d36981c5a6f1}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{d8278076-bc68-4484-9233-6e7f1628b56c}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{f297534d-7b06-459d-bc19-2dd8ef69297b}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\typelib\{9945959c-aad8-4312-8b57-2de11927e770}"
Failed to delete: [Registry Key] "hkey_local_machine\software\microsoft\internet explorer\low rights\elevationpolicy\{6978f29a-3493-40b2-8cdc-9c13a02f85a4}"
Failed to delete: [Registry Key] "hkey_local_machine\software\microsoft\internet explorer\low rights\elevationpolicy\{d7949a66-d936-4028-9552-14f7dc50f38d}"



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\Program Files (x86)\re-markit"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.02.2014 at 12:33:19,09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
__________________
Alt 10.02.2014, 09:12   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Lollipop Network S.L. und weitere - Standard

Lollipop Network S.L. und weitere



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Lollipop Network S.L. und weitere
4d36e972-e325-11ce-bfc1-08002be10318, antivirus, avg antivirus, avira, browser, converter, excel, firefox, home, installation, logfile, lollipop, lollipop network, mozilla, problem, programm, prozess, re-markit, realtek, registry, rundll, scan, scareware, security, svchost.exe, system, usb, warnung, werbung, windows, windowsapps, wlan


« Windows Vista-PC: Avira free Antivirus findet APPL/Downloader.Gen | PUP.Optional.OpenCandy mit Malwarebytes »


Ähnliche Themen: Lollipop Network S.L. und weitere


  1. Lollipop Network S.L deinstalieren
    Plagegeister aller Art und deren Bekämpfung - 27.04.2014 (3)
  2. Win7: Falsche Startseite, Lollipop Network und Pop-Ups
    Log-Analyse und Auswertung - 15.04.2014 (11)
  3. Lollipop Network S.L. entfernen
    Plagegeister aller Art und deren Bekämpfung - 11.03.2014 (33)
  4. Lollipop Network, S.L. - Problem - Wie entferne ich es ?
    Plagegeister aller Art und deren Bekämpfung - 08.03.2014 (13)
  5. Nation-Zoom & Lollipop Network Problem
    Log-Analyse und Auswertung - 21.02.2014 (7)
  6. Lollipop Network, S.L. und nationzoom eingefangen!
    Plagegeister aller Art und deren Bekämpfung - 19.02.2014 (11)
  7. Lollipop Network bei Firefox gefunden und ist nicht zu löschen
    Log-Analyse und Auswertung - 15.02.2014 (14)
  8. Lollipop Network, S.L. entdeckt und kann nicht entfernt werden
    Log-Analyse und Auswertung - 13.02.2014 (15)
  9. Lollipop Network S.L auf Windows 8, geht nicht zu deinstallieren
    Log-Analyse und Auswertung - 10.02.2014 (15)
  10. Lollipop Virus doch nicht gelöscht? Weitere Viren...
    Plagegeister aller Art und deren Bekämpfung - 04.02.2014 (7)
  11. Lollipop Network, S.L.
    Log-Analyse und Auswertung - 04.02.2014 (3)
  12. Lollipop Network Virus, windows7
    Log-Analyse und Auswertung - 30.01.2014 (5)
  13. Entfernen von Lollipop Network S.L.
    Log-Analyse und Auswertung - 25.01.2014 (1)
  14. Kann Lollipop Network s.l. nicht deinstallieren
    Plagegeister aller Art und deren Bekämpfung - 24.01.2014 (5)
  15. Lollipop Network Virus
    Plagegeister aller Art und deren Bekämpfung - 22.01.2014 (10)
  16. lollipop network sl deinstallieren?
    Log-Analyse und Auswertung - 04.01.2014 (13)
  17. Lollipop Network SL auf Windows 8
    Log-Analyse und Auswertung - 23.12.2013 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Lollipop Network S.L. und weitere - Hallo, gestern habe ich das vielfach beschriebenen Lollipop S.L. Programm auf meinem Laptop entdeckt. AVG hat nichts besonderes feststellen können. Mit Malwarebytes konnte ich ca. 160 Treffer landen, darunter war - Lollipop Network S.L. und weitere...
Archiv
Du betrachtest: Lollipop Network S.L. und weitere auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129