netupdater.exe

andiausgraz · 01.04.2014, 19:09

Hallo, ich hab seit 2 Tagen ständig ein Fenster das sich vor allen anderen Fenstern am Desktop legt.

Ich hab im Anhang ein *.gif davon hochgeladen.

Ich denke das dürfte schon bekannt hier sein, da ich schon einiges hier gelesen habe darüber.

Herzlichen Dank im voraus für eure Hilfe

lg Andreas

cosinus · 02.04.2014, 01:11

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

andiausgraz · 02.04.2014, 03:50

Hallo und liebe grüße.

Ich hab die beiden Dateien in Den Anhang gestellt. Ich hoff du kommst damit zurecht?

cosinus · 02.04.2014, 08:28

Zitat:

Ich hab die beiden Dateien in Den Anhang gestellt. Ich hoff du kommst damit zurecht?

Ich hab doch extra dick und fett nen Hinweis dazu gepostet....

andiausgraz · 02.04.2014, 15:30

Hallo Cosinus.

Sorry mein Fehler heute früh in der Eile.

Hoff es geht jetzt so OK?

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Petra (administrator) on WOHNZIMMER on 01-04-2014 17:30:57
Running from C:\Users\Petra\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(CANON INC.) C:\Program Files\Canon\DIAS\CnxDIAS.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
( ) C:\Windows\system32\lxbkcoms.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe
(A-Trust Gesellschaft für Sicherheitssysteme im elektronischen Datenverkehr GmbH) C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(jhyhbgfred) C:\ProgramData\04AMUZrz.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_1_102_ActiveX.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7466600 2011-09-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2821416 2011-08-20] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [lxbkbmgr.exe] - C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmgr.exe [74408 2008-02-28] (Lexmark International, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [336440 2011-06-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-06-14] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-16] (1und1 Mail und Media GmbH)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [AVMUSBFernanschluss] - C:\Users\Petra\AppData\Local\Apps\2.0\5LWJ9PB4.9B5\74QNHXGV.TQ8\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\AVMAutoStart.exe [139264 2012-12-25] (AVM Berlin)
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [BackgroundContainer] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Petra\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [acSecurityLayer] - C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe [3630976 2013-10-14] (A-Trust Gesellschaft für Sicherheitssysteme im elektronischen Datenverkehr GmbH)
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [04AMUZrz] - C:\ProgramData\04AMUZrz.exe [347361 2014-03-17] (jhyhbgfred)
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: G - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: H - H:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: I - I:\LGAutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {07538c4d-5c87-11e2-affe-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {07538c63-5c87-11e2-affe-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {0ea37542-fa70-11e1-b73e-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {152b7fb9-7a74-11e1-a919-e4115bf95cad} - I:\Startme.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {43852091-5fa6-11e2-a645-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {438520d0-5fa6-11e2-a645-e4115bf95cad} - I:\Autorun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {438520d6-5fa6-11e2-a645-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {438520ea-5fa6-11e2-a645-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {6463c1b4-224b-11e1-9521-e4115bf95cad} - H:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {690c13e7-571c-11e2-b8aa-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {7c5d3227-9f48-11e2-96bd-60d819d8d6da} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {b190c04a-5fab-11e2-896d-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {d56db3d6-ab82-11e3-a832-e4115bf95cad} - I:\LGAutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {dc6b99dd-f429-11e1-8afa-e4115bf95cad} - G:\Autorun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {dc6b9a12-f429-11e1-8afa-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {dc6b9a2d-f429-11e1-8afa-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {f42b772e-fa6a-11e1-a5f1-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {f7462a4c-5fa1-11e2-818e-e4115bf95cad} - G:\AutoRun.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CarPort Updater.lnk
ShortcutTarget: CarPort Updater.lnk -> C:\Program Files (x86)\CarPort\CarPort.exe ()
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQCON/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKLM-x32 - Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Program Files (x86)\Pietro_Style\prxtbPie0.dll (Conduit Ltd.)
URLSearchHook: HKCU - Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
URLSearchHook: HKCU - Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Program Files (x86)\Pietro_Style\prxtbPie0.dll (Conduit Ltd.)
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM - {8262B94D-0FB8-44AE-AA96-7114154C01C3} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM-x32 - {8262B94D-0FB8-44AE-AA96-7114154C01C3} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - DefaultScope {B9A1B5C1-350A-4929-ADEE-FF35F3729419} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3010202
SearchScopes: HKCU - {2A157E4D-7060-4D28-8A0A-ED2D12A4ACB7} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKCU - {6131247C-B21A-4B0A-8305-E805ABD144F7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_US&apn_ptnrs=U3&apn_dtid=OSJ000YYAT&apn_uid=626FA10E-BD2C-4511-8C64-62D70E2DDB9E&apn_sauid=038A1828-B387-44AC-9568-A0452A248C8F&
SearchScopes: HKCU - {680D9B3B-9675-45E7-9B40-36A20BA5FF07} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {74968B32-3D01-494B-AF3F-6D130788E863} URL = hxxp://go.gmx.at/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {8262B94D-0FB8-44AE-AA96-7114154C01C3} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {9A208462-F53D-40C5-95F4-C38379F53BB4} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKCU - {B9A1B5C1-350A-4929-ADEE-FF35F3729419} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3010202
SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80720&lng=de
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb201/?search={searchTerms}&loc=IB_DS&a=6Oz0LIqQlK&i=26
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: SaveSense - {0f21b1e5-5afc-43c9-9c66-515046e92ec2} - C:\Program Files (x86)\SaveSense\SaveSenseIE.dll (SaveSense)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: FRITZ!Box Addon BHO - {C0C86BBE-9509-4296-8459-FDBFDAF4B673} - C:\Program Files (x86)\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Program Files (x86)\Pietro_Style\prxtbPie0.dll (Conduit Ltd.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - No Name - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} -  No File
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Program Files (x86)\Pietro_Style\prxtbPie0.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
Toolbar: HKLM-x32 - No Name - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} -  No File
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {E5B8F946-64F0-427B-9482-9252C94874C3} -  No File
Toolbar: HKCU - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect121.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} -  No File
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-08-09] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.at/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U37) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\Petra\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
CHR Plugin: (Java Deployment Toolkit 6.0.370.6) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-29]
CHR Extension: (Google Drive) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-29]
CHR Extension: (YouTube) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-29]
CHR Extension: (Google-Suche) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-29]
CHR Extension: (SaveSense) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\khcceooakamlehbimaepcldnnlnkcmfk [2013-12-30]
CHR Extension: (Norton Identity Protection) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-03-29]
CHR Extension: (Google Wallet) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]
CHR Extension: (Google Mail) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-29]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [2013-03-29]
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [2013-03-29]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\Exts\Chrome.crx [2013-02-05]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.)
R2 Canon Driver Information Assist Service; C:\Program Files\Canon\DIAS\CnxDIAS.exe [4940760 2012-09-04] (CANON INC.)
R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] ()
R2 lxbk_device; C:\Windows\system32\lxbkcoms.exe [565928 2008-02-19] ( )
R2 lxbk_device; C:\Windows\SysWOW64\lxbkcoms.exe [537256 2008-02-19] ( )
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
S2 savesenselive; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2013-12-30] (SaveSense)
S3 savesenselivem; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2013-12-30] (SaveSense)

==================== Drivers (Whitelisted) ====================

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2013-04-18] (LG Electronics Inc.)
S3 AndNetDiag2; C:\Windows\System32\DRIVERS\lgandnetdiag264.sys [29696 2013-04-18] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2013-06-28] (LG Electronics Inc.)
S3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2011-12-09] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2012-12-25] (AVM Berlin)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [133160 2011-06-16] (Broadcom Corporation.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20110519.002\BHDrvx64.sys [1143416 2011-05-13] (Symantec Corporation)
R3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2011-05-21] (Broadcom Corporation.)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys [167072 2012-06-07] (Symantec Corporation)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [216576 2009-09-04] (Huawei Technologies Co., Ltd.)
S3 GemCCID; C:\Windows\System32\DRIVERS\GemCCID.sys [129792 2013-04-24] (Gemalto)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114560 2009-07-24] (Huawei Technologies Co., Ltd.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20110519.031\IDSVia64.sys [488056 2011-05-13] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20110519.002\ENG64.SYS [117880 2011-05-19] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20110519.002\EX64.SYS [2011768 2011-05-19] (Symantec Corporation)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS [737952 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS [37536 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMDS64.SYS [451192 2011-05-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMEFA64.SYS [1129120 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-03-27] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS [190072 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS [405624 2012-04-18] (Symantec Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-01 17:30 - 2014-04-01 17:31 - 00031423 _____ () C:\Users\Petra\Downloads\FRST.txt
2014-04-01 17:30 - 2014-04-01 17:30 - 02157056 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2014-04-01 17:30 - 2014-04-01 17:30 - 00000000 ____D () C:\FRST
2014-04-01 15:16 - 2014-04-01 15:16 - 00000000 ____D () C:\53f52c86cd0452197afeeb22
2014-04-01 08:52 - 2014-04-01 08:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{410E4AEC-2704-475C-B432-7D5046644CF1}
2014-03-31 20:49 - 2014-03-31 20:52 - 00000000 ____D () C:\Users\Petra\AppData\Local\{898FD30F-6CA3-4291-A805-AB6CBF21C21F}
2014-03-31 20:46 - 2014-03-31 20:46 - 00003370 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-03-31 15:30 - 2014-03-31 15:33 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EDDE8AB-14DD-42E7-A96F-BCB48E9D5A8F}
2014-03-31 03:43 - 2014-03-31 03:46 - 00000000 ____D () C:\Users\Petra\AppData\Local\{BBE49052-0CD2-4B8A-9263-109708567F16}
2014-03-30 08:56 - 2014-03-30 08:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{37BA57CF-4BA2-4135-A385-E2FD1193AECE}
2014-03-29 07:45 - 2014-03-29 07:48 - 00000000 ____D () C:\Users\Petra\AppData\Local\{98F6CDF6-F989-46D0-9B3A-8CE763298EEF}
2014-03-28 18:36 - 2014-03-28 18:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1A22D96E-DAC9-463B-8AFE-FB6DE38879BB}
2014-03-28 06:32 - 2014-03-28 06:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{EA06B9B3-FFA3-437D-B459-BC5CCF197A6D}
2014-03-27 18:29 - 2014-03-27 18:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1DD9E130-B39A-40DD-9638-376B4CF64C6B}
2014-03-27 05:59 - 2014-03-27 06:02 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4BD105C1-3E5F-431D-A424-68F1BBCFFE37}
2014-03-26 17:39 - 2014-03-26 17:42 - 00000000 ____D () C:\Users\Petra\AppData\Local\{80E23C48-A37A-4792-B79A-3B83034D0E01}
2014-03-26 05:35 - 2014-03-26 05:38 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A5D83DAD-71C9-4E8A-BA6E-7C53EB3ACA9E}
2014-03-25 12:21 - 2014-03-25 12:21 - 00000000 ____D () C:\Program Files (x86)\MUSICSTATION
2014-03-25 06:11 - 2014-03-25 06:14 - 00000000 ____D () C:\Users\Petra\AppData\Local\{61C328C4-249D-4877-8560-8E8CCECA9227}
2014-03-24 18:08 - 2014-03-24 18:11 - 00000000 ____D () C:\Users\Petra\AppData\Local\{74FB9043-9A42-4E3D-A788-8A721870A7AF}
2014-03-24 05:39 - 2014-03-24 05:42 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D435401C-FB2D-4CB0-9F90-E2735B0F28F9}
2014-03-23 13:22 - 2014-03-23 13:25 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C116116D-4E44-4B90-90BB-C3FFAA4CD12B}
2014-03-22 17:55 - 2014-03-22 17:58 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AAC4104E-FB02-44C3-8ACD-7F284DBF2F7F}
2014-03-22 05:51 - 2014-03-22 05:54 - 00000000 ____D () C:\Users\Petra\AppData\Local\{04112698-1E32-41EB-8B2E-DAE6049B2A53}
2014-03-21 17:48 - 2014-03-21 17:51 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EAE5F2A-71EB-4ED8-AB9F-EED812BFFD4F}
2014-03-21 05:44 - 2014-03-21 05:47 - 00000000 ____D () C:\Users\Petra\AppData\Local\{407BE4CC-DAD6-4C09-9E8A-538D32594C35}
2014-03-20 09:02 - 2014-03-20 09:05 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5E283FB0-7017-47A0-9FD2-EB9536A0BED3}
2014-03-19 19:09 - 2014-03-19 19:11 - 00000000 ____D () C:\Users\Petra\AppData\Local\{406CB15E-9C61-448D-8008-E1E2DB130691}
2014-03-19 07:13 - 2014-03-19 07:13 - 00000000 ____D () C:\Users\Petra\AppData\Local\{51CEB430-CF2E-41D2-B2A4-9665796FA529}
2014-03-18 19:09 - 2014-03-18 19:12 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0AC19F75-90D8-475E-9867-E17A4F0480AC}
2014-03-18 06:47 - 2014-03-18 06:50 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3E95A4D4-58B7-42B8-99BF-7420C72BC97F}
2014-03-17 18:43 - 2014-03-17 18:46 - 00000000 ____D () C:\Users\Petra\AppData\Local\{634A55DB-A8C1-44D5-A8D2-F9585E3055FE}
2014-03-17 18:31 - 2014-03-17 18:31 - 00347361 ____H (jhyhbgfred) C:\ProgramData\04AMUZrz.exe
2014-03-17 06:39 - 2014-03-17 06:42 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7B8EA3F9-896F-4B12-8900-A9FBEAB2EE91}
2014-03-16 12:06 - 2014-03-16 12:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{64ACA087-8ADC-4909-9387-F34188ABF39D}
2014-03-15 20:53 - 2014-03-15 20:56 - 00000000 ____D () C:\Users\Petra\AppData\Local\{09E7FFB7-13CC-4EB4-86AD-33C87D8DDF7E}
2014-03-15 08:49 - 2014-03-15 08:52 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0FA830EC-8387-449F-9929-B44B5013A56A}
2014-03-14 09:40 - 2014-03-14 09:43 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0B35DC25-CAEA-43D5-889F-C48DAF54648B}
2014-03-13 18:35 - 2014-03-13 18:38 - 00000000 ____D () C:\Users\Petra\AppData\Local\{DC42BCC5-9F29-45DF-8874-231FE451365A}
2014-03-13 18:07 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 18:07 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 18:07 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 18:07 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 18:07 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 18:07 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 18:07 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 18:07 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 18:07 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 18:07 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 18:07 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 18:07 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 18:07 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 18:07 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 18:07 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 18:07 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 18:07 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 18:07 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 18:07 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 18:07 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 18:07 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 18:07 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 18:07 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 18:07 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 18:07 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 18:07 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 18:07 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 18:07 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 18:07 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 18:07 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 18:07 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 18:07 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 18:07 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 18:07 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 18:07 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 18:07 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 18:07 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 18:07 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 18:07 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 18:07 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 18:07 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 18:07 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 18:07 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 18:07 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 18:05 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 18:05 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 18:05 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 18:05 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-13 06:31 - 2014-03-13 06:34 - 00000000 ____D () C:\Users\Petra\AppData\Local\{47C37DBC-7E56-4596-9251-CD9C158928EA}
2014-03-12 10:09 - 2014-03-12 10:12 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A819A4C9-A03C-420F-9DF4-15E529A60578}
2014-03-11 18:32 - 2014-03-11 18:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0305664C-9CC1-42AC-A47E-061A4B33CEA5}
2014-03-11 06:28 - 2014-03-11 06:31 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4084983C-F694-4287-8B12-7AA4EE7222D8}
2014-03-10 09:50 - 2014-03-10 09:53 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5C113143-1F1C-42D5-891C-7D9D9B48DCE1}
2014-03-09 21:46 - 2014-03-09 21:49 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3568D60B-823D-4421-A6A1-19155E8D8F05}
2014-03-09 08:32 - 2014-03-31 21:10 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForPetra
2014-03-09 08:32 - 2014-03-31 21:10 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForPetra.job
2014-03-09 08:29 - 2014-03-09 08:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C00D78F4-3E9E-421F-9AB9-4EBF560EA72B}
2014-03-08 08:29 - 2014-03-08 08:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6B4533C3-A8B0-4F33-AB1E-F15ABB16320D}
2014-03-07 07:01 - 2014-03-07 07:01 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6DF6ADA9-1C75-4ECC-888D-46043AAE9714}
2014-03-06 19:00 - 2014-03-06 19:00 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6D7853F2-D8F4-4F21-8C45-CFFB2D3D1D00}
2014-03-06 06:59 - 2014-03-06 07:00 - 00000000 ____D () C:\Users\Petra\AppData\Local\{F9825830-298D-4444-BDAA-2B72A40A19F9}
2014-03-05 18:59 - 2014-03-05 18:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D070BF31-46F0-427F-BA6F-56210297253D}
2014-03-05 14:58 - 2014-03-24 11:58 - 00000000 ____D () C:\Users\Petra\Desktop\Zahnersatz
2014-03-05 06:58 - 2014-03-05 06:58 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AF92FE52-2ECB-4CD6-8DE7-8846D47D5A3F}
2014-03-04 14:55 - 2014-03-04 14:56 - 00000000 ____D () C:\Users\Petra\AppData\Local\{125E8B4C-DCBA-4789-A4A5-03D42769ED64}
2014-03-04 02:55 - 2014-03-04 02:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3FB5D01E-8FAB-460A-B344-2273532679F8}
2014-03-03 14:54 - 2014-03-03 14:54 - 00000000 ____D () C:\Users\Petra\AppData\Local\{68268767-340E-40C7-97A8-5909DF2D92DB}
2014-03-02 09:33 - 2014-03-02 09:33 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5EEEDA96-70E1-4940-8CDA-9115564BA647}

==================== One Month Modified Files and Folders =======

2014-04-01 17:31 - 2014-04-01 17:30 - 00031423 _____ () C:\Users\Petra\Downloads\FRST.txt
2014-04-01 17:30 - 2014-04-01 17:30 - 02157056 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2014-04-01 17:30 - 2014-04-01 17:30 - 00000000 ____D () C:\FRST
2014-04-01 17:28 - 2013-12-30 09:23 - 00000930 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
2014-04-01 17:16 - 2013-12-30 09:23 - 00000292 _____ () C:\Windows\Tasks\SaveSense.job
2014-04-01 17:16 - 2013-01-09 19:08 - 00000437 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-04-01 17:16 - 2012-02-11 10:50 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-01 17:16 - 2011-11-09 03:52 - 01066997 _____ () C:\Windows\WindowsUpdate.log
2014-04-01 15:16 - 2014-04-01 15:16 - 00000000 ____D () C:\53f52c86cd0452197afeeb22
2014-04-01 14:31 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2014-04-01 09:38 - 2013-12-30 09:23 - 00000926 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
2014-04-01 08:55 - 2014-04-01 08:52 - 00000000 ____D () C:\Users\Petra\AppData\Local\{410E4AEC-2704-475C-B432-7D5046644CF1}
2014-04-01 08:34 - 2014-02-01 12:50 - 00054272 _____ () C:\Users\Petra\Desktop\Einkommen &  Ausgaben.ods
2014-03-31 21:10 - 2014-03-09 08:32 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForPetra
2014-03-31 21:10 - 2014-03-09 08:32 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForPetra.job
2014-03-31 20:55 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-31 20:55 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-31 20:52 - 2014-03-31 20:49 - 00000000 ____D () C:\Users\Petra\AppData\Local\{898FD30F-6CA3-4291-A805-AB6CBF21C21F}
2014-03-31 20:47 - 2011-08-09 21:16 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2014-03-31 20:47 - 2011-08-09 21:16 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2014-03-31 20:47 - 2009-07-14 06:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-31 20:46 - 2014-03-31 20:46 - 00003370 _____ () C:\Windows\System32\Tasks\BackgroundContainer Startup Task
2014-03-31 20:45 - 2013-01-17 07:24 - 00013680 _____ () C:\Users\Petra\AppData\Local\carport.ldc
2014-03-31 20:43 - 2012-02-11 10:50 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-31 20:43 - 2011-12-09 11:57 - 00000000 ____D () C:\Users\Petra
2014-03-31 20:42 - 2013-01-14 12:30 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-03-31 20:42 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-31 20:42 - 2009-07-14 05:51 - 00113978 _____ () C:\Windows\setupact.log
2014-03-31 19:40 - 2011-12-09 11:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\Hewlett-Packard
2014-03-31 19:40 - 2011-11-09 04:13 - 00000000 ____D () C:\ProgramData\Norton
2014-03-31 19:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-31 19:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-03-31 15:33 - 2014-03-31 15:30 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EDDE8AB-14DD-42E7-A96F-BCB48E9D5A8F}
2014-03-31 03:46 - 2014-03-31 03:43 - 00000000 ____D () C:\Users\Petra\AppData\Local\{BBE49052-0CD2-4B8A-9263-109708567F16}
2014-03-30 08:59 - 2014-03-30 08:56 - 00000000 ____D () C:\Users\Petra\AppData\Local\{37BA57CF-4BA2-4135-A385-E2FD1193AECE}
2014-03-29 07:48 - 2014-03-29 07:45 - 00000000 ____D () C:\Users\Petra\AppData\Local\{98F6CDF6-F989-46D0-9B3A-8CE763298EEF}
2014-03-28 18:39 - 2014-03-28 18:36 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1A22D96E-DAC9-463B-8AFE-FB6DE38879BB}
2014-03-28 06:35 - 2014-03-28 06:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{EA06B9B3-FFA3-437D-B459-BC5CCF197A6D}
2014-03-27 18:32 - 2014-03-27 18:29 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1DD9E130-B39A-40DD-9638-376B4CF64C6B}
2014-03-27 11:44 - 2013-01-29 19:32 - 00000000 ____D () C:\Users\Petra\Documents\Outlook-Dateien
2014-03-27 06:02 - 2014-03-27 05:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4BD105C1-3E5F-431D-A424-68F1BBCFFE37}
2014-03-26 17:42 - 2014-03-26 17:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{80E23C48-A37A-4792-B79A-3B83034D0E01}
2014-03-26 09:56 - 2014-02-25 19:22 - 00000000 ____D () C:\Users\Petra\Desktop\WHOP
2014-03-26 05:38 - 2014-03-26 05:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A5D83DAD-71C9-4E8A-BA6E-7C53EB3ACA9E}
2014-03-25 14:21 - 2013-11-28 19:10 - 00000000 ____D () C:\Users\Petra\Desktop\ARCHIV
2014-03-25 12:21 - 2014-03-25 12:21 - 00000000 ____D () C:\Program Files (x86)\MUSICSTATION
2014-03-25 06:14 - 2014-03-25 06:11 - 00000000 ____D () C:\Users\Petra\AppData\Local\{61C328C4-249D-4877-8560-8E8CCECA9227}
2014-03-25 05:43 - 2013-12-30 13:23 - 00000144 _____ () C:\Users\Petra\AppData\Roaming\WB.CFG
2014-03-24 18:11 - 2014-03-24 18:08 - 00000000 ____D () C:\Users\Petra\AppData\Local\{74FB9043-9A42-4E3D-A788-8A721870A7AF}
2014-03-24 11:58 - 2014-03-05 14:58 - 00000000 ____D () C:\Users\Petra\Desktop\Zahnersatz
2014-03-24 05:42 - 2014-03-24 05:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D435401C-FB2D-4CB0-9F90-E2735B0F28F9}
2014-03-23 13:25 - 2014-03-23 13:22 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C116116D-4E44-4B90-90BB-C3FFAA4CD12B}
2014-03-22 17:58 - 2014-03-22 17:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AAC4104E-FB02-44C3-8ACD-7F284DBF2F7F}
2014-03-22 05:54 - 2014-03-22 05:51 - 00000000 ____D () C:\Users\Petra\AppData\Local\{04112698-1E32-41EB-8B2E-DAE6049B2A53}
2014-03-21 17:51 - 2014-03-21 17:48 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EAE5F2A-71EB-4ED8-AB9F-EED812BFFD4F}
2014-03-21 16:31 - 2013-06-11 20:21 - 00685568 ___SH () C:\Users\Petra\Desktop\Thumbs.db
2014-03-21 05:47 - 2014-03-21 05:44 - 00000000 ____D () C:\Users\Petra\AppData\Local\{407BE4CC-DAD6-4C09-9E8A-538D32594C35}
2014-03-20 09:05 - 2014-03-20 09:02 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5E283FB0-7017-47A0-9FD2-EB9536A0BED3}
2014-03-19 19:11 - 2014-03-19 19:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{406CB15E-9C61-448D-8008-E1E2DB130691}
2014-03-19 07:13 - 2014-03-19 07:13 - 00000000 ____D () C:\Users\Petra\AppData\Local\{51CEB430-CF2E-41D2-B2A4-9665796FA529}
2014-03-18 19:12 - 2014-03-18 19:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0AC19F75-90D8-475E-9867-E17A4F0480AC}
2014-03-18 06:50 - 2014-03-18 06:47 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3E95A4D4-58B7-42B8-99BF-7420C72BC97F}
2014-03-18 03:05 - 2013-07-28 07:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 03:01 - 2011-12-11 10:01 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-17 18:46 - 2014-03-17 18:43 - 00000000 ____D () C:\Users\Petra\AppData\Local\{634A55DB-A8C1-44D5-A8D2-F9585E3055FE}
2014-03-17 18:31 - 2014-03-17 18:31 - 00347361 ____H (jhyhbgfred) C:\ProgramData\04AMUZrz.exe
2014-03-17 06:42 - 2014-03-17 06:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7B8EA3F9-896F-4B12-8900-A9FBEAB2EE91}
2014-03-16 12:09 - 2014-03-16 12:06 - 00000000 ____D () C:\Users\Petra\AppData\Local\{64ACA087-8ADC-4909-9387-F34188ABF39D}
2014-03-15 20:56 - 2014-03-15 20:53 - 00000000 ____D () C:\Users\Petra\AppData\Local\{09E7FFB7-13CC-4EB4-86AD-33C87D8DDF7E}
2014-03-15 08:52 - 2014-03-15 08:49 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0FA830EC-8387-449F-9929-B44B5013A56A}
2014-03-14 15:18 - 2009-07-14 05:45 - 00416896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 15:14 - 2012-05-10 02:01 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-14 15:14 - 2012-05-10 02:01 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-14 15:14 - 2010-11-21 04:47 - 00211504 _____ () C:\Windows\PFRO.log
2014-03-14 09:50 - 2013-01-17 12:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-14 09:43 - 2014-03-14 09:40 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0B35DC25-CAEA-43D5-889F-C48DAF54648B}
2014-03-13 18:38 - 2014-03-13 18:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{DC42BCC5-9F29-45DF-8874-231FE451365A}
2014-03-13 06:34 - 2014-03-13 06:31 - 00000000 ____D () C:\Users\Petra\AppData\Local\{47C37DBC-7E56-4596-9251-CD9C158928EA}
2014-03-12 10:12 - 2014-03-12 10:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A819A4C9-A03C-420F-9DF4-15E529A60578}
2014-03-11 18:35 - 2014-03-11 18:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0305664C-9CC1-42AC-A47E-061A4B33CEA5}
2014-03-11 06:31 - 2014-03-11 06:28 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4084983C-F694-4287-8B12-7AA4EE7222D8}
2014-03-10 09:53 - 2014-03-10 09:50 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5C113143-1F1C-42D5-891C-7D9D9B48DCE1}
2014-03-09 21:49 - 2014-03-09 21:46 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3568D60B-823D-4421-A6A1-19155E8D8F05}
2014-03-09 12:36 - 2011-12-11 10:03 - 00000000 ____D () C:\Users\Petra\AppData\Local\CrashDumps
2014-03-09 08:32 - 2014-03-09 08:29 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C00D78F4-3E9E-421F-9AB9-4EBF560EA72B}
2014-03-08 08:32 - 2014-03-08 08:29 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6B4533C3-A8B0-4F33-AB1E-F15ABB16320D}
2014-03-07 07:01 - 2014-03-07 07:01 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6DF6ADA9-1C75-4ECC-888D-46043AAE9714}
2014-03-06 19:00 - 2014-03-06 19:00 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6D7853F2-D8F4-4F21-8C45-CFFB2D3D1D00}
2014-03-06 07:00 - 2014-03-06 06:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{F9825830-298D-4444-BDAA-2B72A40A19F9}
2014-03-05 18:59 - 2014-03-05 18:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D070BF31-46F0-427F-BA6F-56210297253D}
2014-03-05 06:58 - 2014-03-05 06:58 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AF92FE52-2ECB-4CD6-8DE7-8846D47D5A3F}
2014-03-04 14:56 - 2014-03-04 14:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{125E8B4C-DCBA-4789-A4A5-03D42769ED64}
2014-03-04 02:55 - 2014-03-04 02:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3FB5D01E-8FAB-460A-B344-2273532679F8}
2014-03-03 14:54 - 2014-03-03 14:54 - 00000000 ____D () C:\Users\Petra\AppData\Local\{68268767-340E-40C7-97A8-5909DF2D92DB}
2014-03-02 09:33 - 2014-03-02 09:33 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5EEEDA96-70E1-4940-8CDA-9115564BA647}

Files to move or delete:
====================
C:\ProgramData\04AMUZrz.exe


Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\ApnStub.exe
C:\Users\Petra\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Petra\AppData\Local\Temp\Extract.exe
C:\Users\Petra\AppData\Local\Temp\gmx_mediacenter_setup_bundled.exe
C:\Users\Petra\AppData\Local\Temp\GMX_Toolbar_IE_Setup.exe
C:\Users\Petra\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Petra\AppData\Local\Temp\incredibar_installer.exe
C:\Users\Petra\AppData\Local\Temp\installhelper.dll
C:\Users\Petra\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Petra\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Petra\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\MyBabylonTB_google_20120807.exe
C:\Users\Petra\AppData\Local\Temp\nshF78F.tmp.tbPiet.dll
C:\Users\Petra\AppData\Local\Temp\nsw7EB2.tmp.tbPiet.dll
C:\Users\Petra\AppData\Local\Temp\OptimizerPro.exe
C:\Users\Petra\AppData\Local\Temp\ResetDevice.exe
C:\Users\Petra\AppData\Local\Temp\Resource.exe
C:\Users\Petra\AppData\Local\Temp\rtdrvmon.exe
C:\Users\Petra\AppData\Local\Temp\sas.exe
C:\Users\Petra\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\Petra\AppData\Local\Temp\sp54620.exe
C:\Users\Petra\AppData\Local\Temp\SP54714.exe
C:\Users\Petra\AppData\Local\Temp\SP56221.exe
C:\Users\Petra\AppData\Local\Temp\sp58915.exe
C:\Users\Petra\AppData\Local\Temp\SP59202.exe
C:\Users\Petra\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Petra\AppData\Local\Temp\TB_DF9A.exe
C:\Users\Petra\AppData\Local\Temp\Uni000.exe
C:\Users\Petra\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Petra\AppData\Local\Temp\UpdateCheckerSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-31 11:36

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Petra at 2014-04-01 17:32:55
Running from C:\Users\Petra\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

a.sign Bürgerkartensoftware 1.4.3.1 (HKLM-x32\...\a.sign Bürgerkartensoftware) (Version: 1.4.3.1 - A-Trust GmbH)
a.sign Client 1.3.2.11 (HKLM-x32\...\a.sign Client) (Version: 1.3.2.11 - A-Trust GmbH)
a.sign PDF 1.11.10.6 (HKLM-x32\...\a.sign PDF) (Version: 1.11.10.6 - A-Trust)
A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version:  - mobilkom austria AG)
A1 Dashboard (x32 Version: 1.8.0.151 - mobilkom austria AG) Hidden
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.5.502.110 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Fuel (Version: 2011.0705.1115.18310 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.60705.1113 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0705.1115.18310 - Ihr Firmenname) Hidden
asignPDFverify 1.0.9.0 (HKLM-x32\...\asignPDFverify) (Version: 1.0.9.0 - A-Trust)
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
AVM FRITZ!Box AddOn (IE) (HKLM-x32\...\{CEAD06D8-D033-4D2A-9328-AF49089E129F}) (Version: 1.7.0 - AVM Berlin)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.100.82.86 - Broadcom Corporation)
Broadcom Bluetooth Software (HKLM\...\{6E7F4CA3-B2DE-413C-A7A1-43AA5BE19EA1}) (Version: 6.5.0.1300 - Broadcom Corporation)
Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.1.1300 - Broadcom Corporation)
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Canon Font Manager (HKLM-x32\...\InstallShield_{BFF1B295-2565-4DF4-B999-9600C8665814}) (Version: 1.00.0000 - Monotype Imaging)
Canon Font Manager (x32 Version: 1.00.0000 - Monotype Imaging) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0705.1115.18310 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0705.1115.18310 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0705.1115.18310 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help English (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help French (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help German (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
ccc-utility64 (Version: 2011.0705.1115.18310 - ATI) Hidden
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.1.4119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{92C42EDD-6524-4577-B2EB-6C68C63B6D4A}) (Version:  - Microsoft)
Deinst. f. Druckertreiber UFR II (HKLM\...\Canon UFR II Printer Driver) (Version: 5, 4, 0, 0 - Canon Inc.)
Elsword_DE (HKLM-x32\...\Elsword_DE_is1) (Version:  - )
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
FRITZ!Box USB-Fernanschluss (HKCU\...\f018cf21c0452c64) (Version: 2.3.0.2 - AVM Berlin)
GMX Desktop Icons (HKLM-x32\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.0.21 - 1&1 Mail & Media GmbH)
GMX MailCheck für Internet Explorer (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.4.0.0 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Connection Manager (HKLM-x32\...\{5E63C0AB-19B0-47D4-842E-6B324EB0614B}) (Version: 4.1.23.1 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{68A55875-B6DD-41E8-8CF6-F193D9C47051}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{D7670221-BF9B-4DFF-B26B-5BE55A87329F}) (Version: 1.2.2 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{8B52057C-15DB-433E-957C-E279BC7D07E3}) (Version: 3.1.0.9742 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
iLivid (HKLM-x32\...\iLivid) (Version: 1.92 - Bandoo Media Inc) <==== ATTENTION
Inbox Toolbar (HKLM-x32\...\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1) (Version: 1.0.0 - Inbox.com, Inc.)
Java(TM) 6 Update 37 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.370 - Oracle)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kundendienste Online 2.0.0.6 (HKLM-x32\...\Kundendienste Online) (Version: 2.0.0.6 - A-Trust GmbH)
Lexmark X1100 Series (HKLM\...\Lexmark X1100 Series) (Version:  - Lexmark International, Inc.)
LG PC Suite (HKLM-x32\...\LG PC Suite) (Version: 5.3.14.20140117 - LG Electronics)
LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5128.5002 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Software Update for Web Folders  (German) 14 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Norton Internet Security (HKLM-x32\...\NIS) (Version: 19.9.1.14 - Symantec Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Pietro Style Toolbar (HKLM-x32\...\Pietro_Style Toolbar) (Version: 6.8.5.1 - Pietro Style)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6461 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
SaveSense (HKCU\...\SaveSense) (Version:  - SaveSense) <==== ATTENTION
SaveSense (remove only) (HKLM-x32\...\SaveSense) (Version: 5.3.0.6 - SaveSense) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.21.0 - Synaptics Incorporated)
Total Commander (Remove or Repair) (HKLM-x32\...\Totalcmd) (Version: 7.56a - Ghisler Software GmbH)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2878227) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5D357893-40BA-4323-86BA-D97C66CD72F4}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E78E2B68-8FD1-42EE-BB74-99A4D9E6222D}) (Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VCDS PCI 11.11 (HKLM-x32\...\VCDS PCI) (Version: PCI 11.11 - PCI Diagnosetechnik GmbH & Co. KG)
VCDS-Lite 1.1 (HKLM-x32\...\VCDS-Lite  1.1) (Version: 1.1 - Ross-Tech)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.36 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - FTDI FTDI D2XX (03/21/2011 2.08.14) (HKLM\...\D6BC3CBE8968CB6351105F9D2EEC52CE24F2C99D) (Version: 03/21/2011 2.08.14 - FTDI)
Windows-Treiberpaket - FTDI FTDI VCP (03/20/2011 2.08.14) (HKLM\...\9FCA89337DAC5D4196D98BF2F17E831E1EE83336) (Version: 03/20/2011 2.08.14 - FTDI)
Windows-Treiberpaket - MPP USB CDC Virtual COM Port (09/16/2011 1.5.0) (HKLM\...\6D3D1B84986E536339ED6F2B2A381D13597CD69C) (Version: 09/16/2011 1.5.0 - MPP)
Windows-Treiberpaket - Ross-Tech USB Driver Package (06/16/2010 2.06.02) (HKLM\...\F2D626F9A8E5C6126BED6EBD3E3504D0B2AB8443) (Version: 06/16/2010 2.06.02 - Ross-Tech)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Restore Points  =========================

04-03-2014 08:21:40 Windows Update
11-03-2014 05:41:50 Windows Update
14-03-2014 08:41:59 Windows Update
18-03-2014 02:00:14 Windows Update
21-03-2014 06:36:30 Windows Update
25-03-2014 13:21:25 Windows Update
29-03-2014 06:59:20 Windows Update
31-03-2014 14:16:49 Wiederherstellungsvorgang
31-03-2014 14:35:11 Windows Update
31-03-2014 18:33:24 Wiederherstellungsvorgang
31-03-2014 19:53:42 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {061B1A79-17A6-49B8-AECD-831D4605C7FB} - System32\Tasks\BackgroundContainer Startup Task => Rundll32.exe "C:\Users\Petra\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <==== ATTENTION
Task: {0B01F23A-EE91-42A4-AFAF-7D9BFC267F8E} - System32\Tasks\{E127C60C-FE1C-4EF2-9470-AB24530DCFB0} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {0D479EDB-4EC3-4635-BC25-2D9A1D3C2095} - System32\Tasks\{074B3F8F-2C94-4392-96B3-81F290A0EDF8} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {133210FC-7CA9-4D1C-BBA4-DB963267C18E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11] (Google Inc.)
Task: {18EF5738-FBCD-47BA-B357-53EC744BDB3D} - System32\Tasks\{0A60719A-A881-43DC-83E3-0B6221D4E062} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {240EF86B-5EC7-4272-890B-E805A3DF3E4B} - System32\Tasks\{3E7E5D69-276B-4C48-9024-3575F0B58D40} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {3440DFB3-8298-4967-BA2D-2CD16BC91FBA} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\WSCStub.exe [2013-02-02] (Symantec Corporation)
Task: {3DB40D5B-244B-4F30-AB60-F3135F2AFB20} - System32\Tasks\{D082E33C-88A5-4580-9033-5CB36C50880F} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {429458FB-A6AC-4588-BF27-1C1AA7F52DAD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11] (Google Inc.)
Task: {43EB0A7E-8244-415F-8712-02FCA525354A} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2013-12-30] (SaveSense) <==== ATTENTION
Task: {4A25F6C5-F5BF-4141-AB72-54659010EAC2} - System32\Tasks\{01BDE0CA-8E94-419D-8B58-CC7D7AFAF5D1} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {4DD2D458-DDEB-408F-9B73-CA08C0FAC88B} - System32\Tasks\{EEBC4047-8894-467E-B7D1-3620F049C20D} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {55F1CD39-5ACC-4DBE-A9A6-2925BE7CA475} - System32\Tasks\SaveSense => C:\Users\Petra\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {584FB204-B139-4920-8523-C156495314D2} - System32\Tasks\HPCeeScheduleForPetra => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {58579AA2-852D-4D3F-94D7-51FC03F56F5A} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {66C64DBF-1108-4EB5-9CEC-809743ED6C5B} - System32\Tasks\{57524BE1-7C34-47D2-9ACD-1E9ACE7C0053} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {6C1672BB-0DA5-47AF-8515-DBC2E254A915} - System32\Tasks\{6794C280-FF5A-457D-96DD-9C0A28A9BA23} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {784C0C1B-840C-4420-A79B-33961BBF428F} - System32\Tasks\{E6BFF561-0BE9-4438-9B9E-161FDBE71697} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {7FD261C3-869C-4594-A9AA-1A0D6853D724} - System32\Tasks\{6A335AC3-D24A-47E5-AEED-CBE6C337F233} => C:\Users\Petra\Downloads\comport\ComPortMan\ComPortMan.exe [2013-01-14] (Uwe Sieber - www.uwe-sieber.de)
Task: {9B25CE7D-DEC0-4440-8EC6-24791BD98EF1} - System32\Tasks\{705006BC-1C0C-4FFC-8F8C-D067283032F8} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {9D62E63B-426A-4074-9020-92F3155489E3} - System32\Tasks\{533D0D77-5CEF-4D3A-A351-92AB6276631D} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {9EA4CDB6-BEB0-4552-85AF-D372F29A4017} - System32\Tasks\{7CA38709-3138-4B5F-8107-97396C909E2B} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {A3E218D2-63EF-4729-BE84-9FBF37ED460C} - System32\Tasks\{73B0981E-660E-4EA0-8DE2-F9E06AA84E5C} => C:\Program Files (x86)\Microsoft Office\Options14\MSOO.EXE [2013-07-23] (Microsoft Corporation)
Task: {AF34E210-8687-4AC5-BFBD-91D6D2E3692E} - System32\Tasks\{7A0B4CD7-5FD5-4E54-8D3C-FCB892A1E235} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {BB6FF632-6AAD-4FE8-88F7-23252587EDB7} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2013-12-30] (SaveSense) <==== ATTENTION
Task: {C6D22691-5E5A-4458-B252-37F8494F5240} - System32\Tasks\{2FF47835-EDC5-4376-A145-76579C2A2B15} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {CD129565-94DB-4A23-8860-9CAE378E38DB} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {D393C5C7-33E6-4346-B635-727A2B69339D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {D84AC053-9E87-4E82-B84D-EB9B1326727B} - System32\Tasks\{A7ED017B-DF13-47E0-83FE-3DD5BA226DDC} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {DED7FC1F-EBD1-4265-92C0-8930228036F6} - System32\Tasks\{5915D1F3-8440-4E1B-A310-6B6F123A2699} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {DF08D6E9-D0C2-4CA3-96EF-765DA42E1C3C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {E1D89132-254A-4ADA-A61D-885598792C42} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {F09C4B2B-AF46-4CFE-99CF-575D5CC3EBAB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {FC7E1AE3-016B-4267-A71F-B18239320A27} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2013-06-18] (1&1 Mail & Media GmbH)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForPetra.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\Petra\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-07-05 11:27 - 2011-07-05 11:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-16 18:57 - 2011-06-16 18:57 - 00081696 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\BtwLeLib.dll
2013-01-17 11:52 - 2003-04-18 19:06 - 00008192 _____ () C:\Windows\SysWOW64\srvany.exe
2013-01-17 11:52 - 2010-04-10 09:03 - 00077824 _____ () C:\Windows\KMService.exe
2005-09-13 16:27 - 2005-09-13 16:27 - 00054784 _____ () C:\Windows\system32\lxbkcnv5.dll
2011-04-27 17:05 - 2011-04-27 17:05 - 01102336 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll
2011-07-05 11:27 - 2011-07-05 11:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 11:13 - 2011-07-05 11:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-10-14 09:17 - 2013-10-14 09:17 - 02393984 _____ () C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\Xalan-C_1_10.dll
2013-10-14 09:17 - 2013-10-14 09:17 - 00008064 _____ () C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\XalanMessages_1_10.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2012-08-10 16:50 - 2012-08-10 16:50 - 00170496 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxslt.dll
2011-04-27 17:05 - 2011-04-27 17:05 - 00514570 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll
2014-03-15 18:59 - 2014-03-15 01:50 - 00051016 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll
2014-03-15 18:59 - 2014-03-15 01:50 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libglesv2.dll
2014-03-15 18:59 - 2014-03-15 01:50 - 00100168 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libegl.dll
2014-03-15 18:59 - 2014-03-15 01:50 - 04061000 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll
2014-03-15 18:59 - 2014-03-15 01:50 - 00394568 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll
2014-03-15 18:59 - 2014-03-15 01:50 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll
2014-03-15 18:59 - 2014-03-15 01:50 - 13637448 _____ () C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: USB-Verbundgerät
Description: USB-Verbundgerät
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: usbccgp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/01/2014 03:42:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/01/2014 02:30:17 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/01/2014 07:13:20 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (03/31/2014 09:05:44 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (03/31/2014 09:05:44 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (03/31/2014 09:05:44 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (03/31/2014 08:43:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 04:24:08 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 00:37:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 11:40:13 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.


System errors:
=============
Error: (04/01/2014 05:31:15 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/01/2014 05:29:01 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/01/2014 05:22:46 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/01/2014 05:20:04 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/01/2014 05:18:04 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/01/2014 05:15:57 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/01/2014 05:15:56 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (04/01/2014 03:42:33 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/01/2014 03:39:37 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/01/2014 03:37:23 PM) (Source: ipnathlp) (User: )
Description: 


Microsoft Office Sessions:
=========================
Error: (04/01/2014 03:42:24 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files (x86)\lg electronics\lg pc suite\LGPCSuite.exe

Error: (04/01/2014 02:30:17 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files (x86)\lg electronics\lg pc suite\LGPCSuite.exe

Error: (04/01/2014 07:13:20 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files (x86)\lg electronics\lg pc suite\LGPCSuite.exe

Error: (03/31/2014 09:05:44 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (03/31/2014 09:05:44 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (03/31/2014 09:05:44 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (03/31/2014 08:43:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 04:24:08 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 00:37:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/31/2014 11:40:13 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestc:\program files (x86)\lg electronics\lg pc suite\LGPCSuite.exe


CodeIntegrity Errors:
===================================
  Date: 2013-01-16 07:31:34.658
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:31:34.549
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:00:41.155
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:00:41.046
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-15 19:20:35.772
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-15 19:20:35.632
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 59%
Total physical RAM: 3690.91 MB
Available physical RAM: 1512.48 MB
Total Pagefile: 7379.99 MB
Available Pagefile: 4697.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:446.09 GB) (Free:372.77 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.51 GB) (Free:1.69 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32
Drive g: (A1) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS
Drive h: (MICROSD2GB) (Removable) (Total:1.91 GB) (Free:0.48 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F2DC90A7)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

cosinus · 02.04.2014, 21:21

Was ist mit meiner Frage nach bisherigen Funden? Alle Logs mit bisherigen Funden biite posten

Außerdem:

Zitat:

R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] ()

Du hast ein gecracktes Microsoft Office drauf. Bevor es überhaupt weitergeht muss das deinstalliert werden.

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

andiausgraz · 03.04.2014, 16:36

Hallo Cosinus.

War mir eigentlich gar nicht so bewusst wegen dem Office, da wir auf unserem Rechner das OPEN Office verwenden.

Ich hab alles was ich gefunden hab vom Microsoft Office deinstalliert. Hoffe das ist so in Ordnung?

Hab jetzt noch mal die 2 Textdateien gemacht.

Ich hab noch eine log vom Winzip Malware Protector. Allerdings ist das eine XML Datei. Weis aber leider nicht ob ich das auch so mit dem Code einfügen kann.

Musste das Log File in eine Zip Datei geben.

Lg Andreas

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Petra at 2014-04-03 17:19:03
Running from C:\Users\Petra\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

a.sign Bürgerkartensoftware 1.4.3.1 (HKLM-x32\...\a.sign Bürgerkartensoftware) (Version: 1.4.3.1 - A-Trust GmbH)
a.sign Client 1.3.2.11 (HKLM-x32\...\a.sign Client) (Version: 1.3.2.11 - A-Trust GmbH)
a.sign PDF 1.11.10.6 (HKLM-x32\...\a.sign PDF) (Version: 1.11.10.6 - A-Trust)
A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version:  - mobilkom austria AG)
A1 Dashboard (x32 Version: 1.8.0.151 - mobilkom austria AG) Hidden
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.5.502.110 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Fuel (Version: 2011.0705.1115.18310 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.60705.1113 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0705.1115.18310 - Ihr Firmenname) Hidden
asignPDFverify 1.0.9.0 (HKLM-x32\...\asignPDFverify) (Version: 1.0.9.0 - A-Trust)
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
AVM FRITZ!Box AddOn (IE) (HKLM-x32\...\{CEAD06D8-D033-4D2A-9328-AF49089E129F}) (Version: 1.7.0 - AVM Berlin)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.100.82.86 - Broadcom Corporation)
Broadcom Bluetooth Software (HKLM\...\{6E7F4CA3-B2DE-413C-A7A1-43AA5BE19EA1}) (Version: 6.5.0.1300 - Broadcom Corporation)
Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.1.1300 - Broadcom Corporation)
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Canon Font Manager (HKLM-x32\...\InstallShield_{BFF1B295-2565-4DF4-B999-9600C8665814}) (Version: 1.00.0000 - Monotype Imaging)
Canon Font Manager (x32 Version: 1.00.0000 - Monotype Imaging) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0705.1115.18310 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0705.1115.18310 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0705.1115.18310 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help English (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help French (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help German (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
ccc-utility64 (Version: 2011.0705.1115.18310 - ATI) Hidden
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.1.4119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Deinst. f. Druckertreiber UFR II (HKLM\...\Canon UFR II Printer Driver) (Version: 5, 4, 0, 0 - Canon Inc.)
Elsword_DE (HKLM-x32\...\Elsword_DE_is1) (Version:  - )
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
FRITZ!Box USB-Fernanschluss (HKCU\...\f018cf21c0452c64) (Version: 2.3.0.2 - AVM Berlin)
GMX Desktop Icons (HKLM-x32\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.0.21 - 1&1 Mail & Media GmbH)
GMX MailCheck für Internet Explorer (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.4.0.0 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Connection Manager (HKLM-x32\...\{5E63C0AB-19B0-47D4-842E-6B324EB0614B}) (Version: 4.1.23.1 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{68A55875-B6DD-41E8-8CF6-F193D9C47051}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{D7670221-BF9B-4DFF-B26B-5BE55A87329F}) (Version: 1.2.2 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{8B52057C-15DB-433E-957C-E279BC7D07E3}) (Version: 3.1.0.9742 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
iLivid (HKLM-x32\...\iLivid) (Version: 1.92 - Bandoo Media Inc) <==== ATTENTION
Inbox Toolbar (HKLM-x32\...\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1) (Version: 1.0.0 - Inbox.com, Inc.)
Java(TM) 6 Update 37 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.370 - Oracle)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kundendienste Online 2.0.0.6 (HKLM-x32\...\Kundendienste Online) (Version: 2.0.0.6 - A-Trust GmbH)
Lexmark X1100 Series (HKLM\...\Lexmark X1100 Series) (Version:  - Lexmark International, Inc.)
LG PC Suite (HKLM-x32\...\LG PC Suite) (Version: 5.3.14.20140117 - LG Electronics)
LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Software Update for Web Folders  (German) 14 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Norton Internet Security (HKLM-x32\...\NIS) (Version: 19.9.1.14 - Symantec Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Pietro Style Toolbar (HKLM-x32\...\Pietro_Style Toolbar) (Version: 6.8.5.1 - Pietro Style)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6461 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
SaveSense (HKCU\...\SaveSense) (Version:  - SaveSense) <==== ATTENTION
SaveSense (remove only) (HKLM-x32\...\SaveSense) (Version: 5.3.0.6 - SaveSense) <==== ATTENTION
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.21.0 - Synaptics Incorporated)
Total Commander (Remove or Repair) (HKLM-x32\...\Totalcmd) (Version: 7.56a - Ghisler Software GmbH)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VCDS PCI 11.11 (HKLM-x32\...\VCDS PCI) (Version: PCI 11.11 - PCI Diagnosetechnik GmbH & Co. KG)
VCDS-Lite 1.1 (HKLM-x32\...\VCDS-Lite  1.1) (Version: 1.1 - Ross-Tech)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.36 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - FTDI FTDI D2XX (03/21/2011 2.08.14) (HKLM\...\D6BC3CBE8968CB6351105F9D2EEC52CE24F2C99D) (Version: 03/21/2011 2.08.14 - FTDI)
Windows-Treiberpaket - FTDI FTDI VCP (03/20/2011 2.08.14) (HKLM\...\9FCA89337DAC5D4196D98BF2F17E831E1EE83336) (Version: 03/20/2011 2.08.14 - FTDI)
Windows-Treiberpaket - MPP USB CDC Virtual COM Port (09/16/2011 1.5.0) (HKLM\...\6D3D1B84986E536339ED6F2B2A381D13597CD69C) (Version: 09/16/2011 1.5.0 - MPP)
Windows-Treiberpaket - Ross-Tech USB Driver Package (06/16/2010 2.06.02) (HKLM\...\F2D626F9A8E5C6126BED6EBD3E3504D0B2AB8443) (Version: 06/16/2010 2.06.02 - Ross-Tech)
WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10798 - WinZip International LLC)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Restore Points  =========================

11-03-2014 05:41:50 Windows Update
14-03-2014 08:41:59 Windows Update
18-03-2014 02:00:14 Windows Update
21-03-2014 06:36:30 Windows Update
25-03-2014 13:21:25 Windows Update
29-03-2014 06:59:20 Windows Update
31-03-2014 14:16:49 Wiederherstellungsvorgang
31-03-2014 14:35:11 Windows Update
31-03-2014 18:33:24 Wiederherstellungsvorgang
31-03-2014 19:53:42 Windows Update
03-04-2014 15:49:46 Microsoft Office Klick-und-Los 2010 wird entfernt
03-04-2014 15:51:59 Microsoft Office 2010 wird entfernt
03-04-2014 15:53:50 Removed Microsoft Office Home and Business 2010

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0B01F23A-EE91-42A4-AFAF-7D9BFC267F8E} - System32\Tasks\{E127C60C-FE1C-4EF2-9470-AB24530DCFB0} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {0D479EDB-4EC3-4635-BC25-2D9A1D3C2095} - System32\Tasks\{074B3F8F-2C94-4392-96B3-81F290A0EDF8} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {133210FC-7CA9-4D1C-BBA4-DB963267C18E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11] (Google Inc.)
Task: {18EF5738-FBCD-47BA-B357-53EC744BDB3D} - System32\Tasks\{0A60719A-A881-43DC-83E3-0B6221D4E062} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {240EF86B-5EC7-4272-890B-E805A3DF3E4B} - System32\Tasks\{3E7E5D69-276B-4C48-9024-3575F0B58D40} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {3440DFB3-8298-4967-BA2D-2CD16BC91FBA} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\WSCStub.exe [2013-02-02] (Symantec Corporation)
Task: {3DB40D5B-244B-4F30-AB60-F3135F2AFB20} - System32\Tasks\{D082E33C-88A5-4580-9033-5CB36C50880F} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {429458FB-A6AC-4588-BF27-1C1AA7F52DAD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11] (Google Inc.)
Task: {43EB0A7E-8244-415F-8712-02FCA525354A} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2013-12-30] (SaveSense) <==== ATTENTION
Task: {4A25F6C5-F5BF-4141-AB72-54659010EAC2} - System32\Tasks\{01BDE0CA-8E94-419D-8B58-CC7D7AFAF5D1} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {4DD2D458-DDEB-408F-9B73-CA08C0FAC88B} - System32\Tasks\{EEBC4047-8894-467E-B7D1-3620F049C20D} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {55F1CD39-5ACC-4DBE-A9A6-2925BE7CA475} - System32\Tasks\SaveSense => C:\Users\Petra\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {584FB204-B139-4920-8523-C156495314D2} - System32\Tasks\HPCeeScheduleForPetra => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {58579AA2-852D-4D3F-94D7-51FC03F56F5A} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {66C64DBF-1108-4EB5-9CEC-809743ED6C5B} - System32\Tasks\{57524BE1-7C34-47D2-9ACD-1E9ACE7C0053} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {6C1672BB-0DA5-47AF-8515-DBC2E254A915} - System32\Tasks\{6794C280-FF5A-457D-96DD-9C0A28A9BA23} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {784C0C1B-840C-4420-A79B-33961BBF428F} - System32\Tasks\{E6BFF561-0BE9-4438-9B9E-161FDBE71697} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {7FD261C3-869C-4594-A9AA-1A0D6853D724} - System32\Tasks\{6A335AC3-D24A-47E5-AEED-CBE6C337F233} => C:\Users\Petra\Downloads\comport\ComPortMan\ComPortMan.exe [2013-01-14] (Uwe Sieber - www.uwe-sieber.de)
Task: {9B25CE7D-DEC0-4440-8EC6-24791BD98EF1} - System32\Tasks\{705006BC-1C0C-4FFC-8F8C-D067283032F8} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {9D62E63B-426A-4074-9020-92F3155489E3} - System32\Tasks\{533D0D77-5CEF-4D3A-A351-92AB6276631D} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {9EA4CDB6-BEB0-4552-85AF-D372F29A4017} - System32\Tasks\{7CA38709-3138-4B5F-8107-97396C909E2B} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {A3E218D2-63EF-4729-BE84-9FBF37ED460C} - System32\Tasks\{73B0981E-660E-4EA0-8DE2-F9E06AA84E5C} => C:\Program Files (x86)\Microsoft Office\Options14\MSOO.EXE
Task: {AF34E210-8687-4AC5-BFBD-91D6D2E3692E} - System32\Tasks\{7A0B4CD7-5FD5-4E54-8D3C-FCB892A1E235} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {BB6FF632-6AAD-4FE8-88F7-23252587EDB7} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2013-12-30] (SaveSense) <==== ATTENTION
Task: {C6D22691-5E5A-4458-B252-37F8494F5240} - System32\Tasks\{2FF47835-EDC5-4376-A145-76579C2A2B15} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {CD129565-94DB-4A23-8860-9CAE378E38DB} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {D393C5C7-33E6-4346-B635-727A2B69339D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {D84AC053-9E87-4E82-B84D-EB9B1326727B} - System32\Tasks\{A7ED017B-DF13-47E0-83FE-3DD5BA226DDC} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {D9868A43-E633-4E50-AEC6-E8C2E701BAB4} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {DED7FC1F-EBD1-4265-92C0-8930228036F6} - System32\Tasks\{5915D1F3-8440-4E1B-A310-6B6F123A2699} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {DF08D6E9-D0C2-4CA3-96EF-765DA42E1C3C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {E1D89132-254A-4ADA-A61D-885598792C42} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {F09C4B2B-AF46-4CFE-99CF-575D5CC3EBAB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {FC7E1AE3-016B-4267-A71F-B18239320A27} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2013-06-18] (1&1 Mail & Media GmbH)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForPetra.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\Petra\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-07-05 11:27 - 2011-07-05 11:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-16 18:57 - 2011-06-16 18:57 - 00081696 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\BtwLeLib.dll
2013-01-17 11:52 - 2003-04-18 19:06 - 00008192 _____ () C:\Windows\SysWOW64\srvany.exe
2013-01-17 11:52 - 2010-04-10 09:03 - 00077824 _____ () C:\Windows\KMService.exe
2005-09-13 16:27 - 2005-09-13 16:27 - 00054784 _____ () C:\Windows\system32\lxbkcnv5.dll
2011-07-05 11:27 - 2011-07-05 11:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 11:13 - 2011-07-05 11:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-10-14 09:17 - 2013-10-14 09:17 - 02393984 _____ () C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\Xalan-C_1_10.dll
2013-10-14 09:17 - 2013-10-14 09:17 - 00008064 _____ () C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\XalanMessages_1_10.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: USB-Verbundgerät
Description: USB-Verbundgerät
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: usbccgp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/03/2014 05:05:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/03/2014 05:01:51 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 05:01:51 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 05:00:29 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 05:00:29 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 04:59:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 04:59:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 04:54:03 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 04:54:03 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (04/03/2014 04:51:30 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.


System errors:
=============
Error: (04/03/2014 05:20:12 PM) (Source: DCOM) (User: WOHNZIMMER)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}WOHNZIMMERPetraS-1-5-21-3867768323-361688634-2235168212-1001LocalHost (unter Verwendung von LRPC)

Error: (04/03/2014 05:20:12 PM) (Source: DCOM) (User: WOHNZIMMER)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}WOHNZIMMERPetraS-1-5-21-3867768323-361688634-2235168212-1001LocalHost (unter Verwendung von LRPC)

Error: (04/03/2014 05:08:26 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/03/2014 05:02:28 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/03/2014 05:02:18 PM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (04/03/2014 04:58:32 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/03/2014 04:56:18 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/03/2014 04:50:04 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/03/2014 04:47:50 PM) (Source: ipnathlp) (User: )
Description: 

Error: (04/03/2014 04:47:02 PM) (Source: ipnathlp) (User: )
Description: 0


Microsoft Office Sessions:
=========================
Error: (04/03/2014 05:05:26 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/03/2014 05:01:51 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 05:01:51 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 05:00:29 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 05:00:29 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 04:59:43 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 04:59:43 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 04:54:03 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 04:54:03 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (04/03/2014 04:51:30 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe


CodeIntegrity Errors:
===================================
  Date: 2013-01-16 07:31:34.658
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:31:34.549
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:00:41.155
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:00:41.046
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-15 19:20:35.772
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-15 19:20:35.632
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 46%
Total physical RAM: 3690.91 MB
Available physical RAM: 1970.88 MB
Total Pagefile: 7379.99 MB
Available Pagefile: 5291.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:446.09 GB) (Free:379.63 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.51 GB) (Free:1.69 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32
Drive g: (A1) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS
Drive h: (MICROSD2GB) (Removable) (Total:1.91 GB) (Free:0.48 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F2DC90A7)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Petra (administrator) on WOHNZIMMER on 03-04-2014 17:16:27
Running from C:\Users\Petra\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(CANON INC.) C:\Program Files\Canon\DIAS\CnxDIAS.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
( ) C:\Windows\system32\lxbkcoms.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe
(A-Trust Gesellschaft für Sicherheitssysteme im elektronischen Datenverkehr GmbH) C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(jhyhbgfred) C:\ProgramData\04AMUZrz.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(AVM Berlin) C:\Users\Petra\AppData\Local\Apps\2.0\5LWJ9PB4.9B5\74QNHXGV.TQ8\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\system32\consent.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_1_102_ActiveX.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7466600 2011-09-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2821416 2011-08-20] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [lxbkbmgr.exe] - C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmgr.exe [74408 2008-02-28] (Lexmark International, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [336440 2011-06-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-06-14] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-16] (1und1 Mail und Media GmbH)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [AVMUSBFernanschluss] - C:\Users\Petra\AppData\Local\Apps\2.0\5LWJ9PB4.9B5\74QNHXGV.TQ8\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\AVMAutoStart.exe [139264 2012-12-25] (AVM Berlin)
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [acSecurityLayer] - C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe [3630976 2013-10-14] (A-Trust Gesellschaft für Sicherheitssysteme im elektronischen Datenverkehr GmbH)
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [04AMUZrz] - C:\ProgramData\04AMUZrz.exe [347361 2014-03-17] (jhyhbgfred)
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [BackgroundContainerV2] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Petra\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: G - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: H - H:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: I - I:\LGAutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {07538c4d-5c87-11e2-affe-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {07538c63-5c87-11e2-affe-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {0ea37542-fa70-11e1-b73e-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {152b7fb9-7a74-11e1-a919-e4115bf95cad} - I:\Startme.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {43852091-5fa6-11e2-a645-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {438520d0-5fa6-11e2-a645-e4115bf95cad} - I:\Autorun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {438520d6-5fa6-11e2-a645-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {438520ea-5fa6-11e2-a645-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {6463c1b4-224b-11e1-9521-e4115bf95cad} - H:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {690c13e7-571c-11e2-b8aa-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {7c5d3227-9f48-11e2-96bd-60d819d8d6da} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {b190c04a-5fab-11e2-896d-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {d56db3d6-ab82-11e3-a832-e4115bf95cad} - I:\LGAutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {dc6b99dd-f429-11e1-8afa-e4115bf95cad} - G:\Autorun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {dc6b9a12-f429-11e1-8afa-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {dc6b9a2d-f429-11e1-8afa-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {f42b772e-fa6a-11e1-a5f1-e4115bf95cad} - G:\AutoRun.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\MountPoints2: {f7462a4c-5fa1-11e2-818e-e4115bf95cad} - G:\AutoRun.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CarPort Updater.lnk
ShortcutTarget: CarPort Updater.lnk -> C:\Program Files (x86)\CarPort\CarPort.exe ()
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQCON/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKLM-x32 - Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll (ClientConnect Ltd.)
URLSearchHook: HKCU - Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
URLSearchHook: HKCU - Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll (ClientConnect Ltd.)
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM - {8262B94D-0FB8-44AE-AA96-7114154C01C3} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM-x32 - {8262B94D-0FB8-44AE-AA96-7114154C01C3} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - DefaultScope {B9A1B5C1-350A-4929-ADEE-FF35F3729419} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3010202
SearchScopes: HKCU - {2A157E4D-7060-4D28-8A0A-ED2D12A4ACB7} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKCU - {6131247C-B21A-4B0A-8305-E805ABD144F7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_US&apn_ptnrs=U3&apn_dtid=OSJ000YYAT&apn_uid=626FA10E-BD2C-4511-8C64-62D70E2DDB9E&apn_sauid=038A1828-B387-44AC-9568-A0452A248C8F&
SearchScopes: HKCU - {680D9B3B-9675-45E7-9B40-36A20BA5FF07} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {74968B32-3D01-494B-AF3F-6D130788E863} URL = hxxp://go.gmx.at/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {8262B94D-0FB8-44AE-AA96-7114154C01C3} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {9A208462-F53D-40C5-95F4-C38379F53BB4} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKCU - {B9A1B5C1-350A-4929-ADEE-FF35F3729419} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3010202
SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80720&lng=de
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb201/?search={searchTerms}&loc=IB_DS&a=6Oz0LIqQlK&i=26
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: SaveSense - {0f21b1e5-5afc-43c9-9c66-515046e92ec2} - C:\Program Files (x86)\SaveSense\SaveSenseIE.dll (SaveSense)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: FRITZ!Box Addon BHO - {C0C86BBE-9509-4296-8459-FDBFDAF4B673} - C:\Program Files (x86)\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Inbox Toolbar - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll (ClientConnect Ltd.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - No Name - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} -  No File
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Pietro Style Toolbar - {e5b8f946-64f0-427b-9482-9252c94874c3} - C:\Users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll (ClientConnect Ltd.)
Toolbar: HKLM-x32 - &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
Toolbar: HKLM-x32 - No Name - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} -  No File
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {E5B8F946-64F0-427B-9482-9252C94874C3} -  No File
Toolbar: HKCU - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect121.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} -  No File
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files (x86)\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-08-09] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.at/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U37) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\Petra\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
CHR Plugin: (Java Deployment Toolkit 6.0.370.6) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-29]
CHR Extension: (Google Drive) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-29]
CHR Extension: (YouTube) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-29]
CHR Extension: (Google-Suche) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-29]
CHR Extension: (SaveSense) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\khcceooakamlehbimaepcldnnlnkcmfk [2013-12-30]
CHR Extension: (Norton Identity Protection) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-03-29]
CHR Extension: (Google Wallet) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]
CHR Extension: (Google Mail) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-29]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [2013-03-29]
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [2013-03-29]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\Exts\Chrome.crx [2013-02-05]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.)
R2 Canon Driver Information Assist Service; C:\Program Files\Canon\DIAS\CnxDIAS.exe [4940760 2012-09-04] (CANON INC.)
R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] ()
R2 lxbk_device; C:\Windows\system32\lxbkcoms.exe [565928 2008-02-19] ( )
R2 lxbk_device; C:\Windows\SysWOW64\lxbkcoms.exe [537256 2008-02-19] ( )
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
S2 savesenselive; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2013-12-30] (SaveSense)
S3 savesenselivem; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2013-12-30] (SaveSense)

==================== Drivers (Whitelisted) ====================

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2013-04-18] (LG Electronics Inc.)
S3 AndNetDiag2; C:\Windows\System32\DRIVERS\lgandnetdiag264.sys [29696 2013-04-18] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2013-06-28] (LG Electronics Inc.)
S3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2011-12-09] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2012-12-25] (AVM Berlin)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [133160 2011-06-16] (Broadcom Corporation.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20110519.002\BHDrvx64.sys [1143416 2011-05-13] (Symantec Corporation)
S3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2011-05-21] (Broadcom Corporation.)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys [167072 2012-06-07] (Symantec Corporation)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [216576 2009-09-04] (Huawei Technologies Co., Ltd.)
S3 GemCCID; C:\Windows\System32\DRIVERS\GemCCID.sys [129792 2013-04-24] (Gemalto)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114560 2009-07-24] (Huawei Technologies Co., Ltd.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20110519.031\IDSVia64.sys [488056 2011-05-13] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20110519.002\ENG64.SYS [117880 2011-05-19] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20110519.002\EX64.SYS [2011768 2011-05-19] (Symantec Corporation)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS [737952 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS [37536 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMDS64.SYS [451192 2011-05-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMEFA64.SYS [1129120 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-03-27] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS [190072 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS [405624 2012-04-18] (Symantec Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-03 17:12 - 2014-04-03 17:12 - 00119372 _____ () C:\Users\Petra\Desktop\log.xml
2014-04-03 16:46 - 2014-04-03 16:49 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7A9B454C-DF17-45FC-97B9-975301CAAB35}
2014-04-03 04:42 - 2014-04-03 04:45 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1801A9C0-7C1C-4624-8430-8AFFF29ECA7E}
2014-04-02 21:01 - 2014-04-02 21:01 - 00000000 ____D () C:\Users\Petra\Desktop\Virus nicht löschen
2014-04-02 19:37 - 2014-04-03 17:09 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-04-02 19:36 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-04-02 16:40 - 2014-04-02 16:40 - 05192353 _____ (Swearware) C:\Users\Petra\Downloads\ComboFix.exe
2014-04-02 10:48 - 2014-04-02 10:51 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7C885690-C00B-441A-AA55-28EE92CC00C7}
2014-04-01 20:56 - 2014-04-01 20:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7AFF5624-F2AC-4BA9-AFED-398D71E8F882}
2014-04-01 17:32 - 2014-04-01 17:34 - 00055412 _____ () C:\Users\Petra\Downloads\Addition.txt
2014-04-01 17:30 - 2014-04-03 17:17 - 00030470 _____ () C:\Users\Petra\Downloads\FRST.txt
2014-04-01 17:30 - 2014-04-03 17:16 - 00000000 ____D () C:\FRST
2014-04-01 17:30 - 2014-04-01 17:30 - 02157056 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2014-04-01 08:52 - 2014-04-01 08:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{410E4AEC-2704-475C-B432-7D5046644CF1}
2014-03-31 20:49 - 2014-03-31 20:52 - 00000000 ____D () C:\Users\Petra\AppData\Local\{898FD30F-6CA3-4291-A805-AB6CBF21C21F}
2014-03-31 15:30 - 2014-03-31 15:33 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EDDE8AB-14DD-42E7-A96F-BCB48E9D5A8F}
2014-03-31 03:43 - 2014-03-31 03:46 - 00000000 ____D () C:\Users\Petra\AppData\Local\{BBE49052-0CD2-4B8A-9263-109708567F16}
2014-03-30 08:56 - 2014-03-30 08:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{37BA57CF-4BA2-4135-A385-E2FD1193AECE}
2014-03-29 07:45 - 2014-03-29 07:48 - 00000000 ____D () C:\Users\Petra\AppData\Local\{98F6CDF6-F989-46D0-9B3A-8CE763298EEF}
2014-03-28 18:36 - 2014-03-28 18:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1A22D96E-DAC9-463B-8AFE-FB6DE38879BB}
2014-03-28 06:32 - 2014-03-28 06:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{EA06B9B3-FFA3-437D-B459-BC5CCF197A6D}
2014-03-27 18:29 - 2014-03-27 18:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1DD9E130-B39A-40DD-9638-376B4CF64C6B}
2014-03-27 05:59 - 2014-03-27 06:02 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4BD105C1-3E5F-431D-A424-68F1BBCFFE37}
2014-03-26 17:39 - 2014-03-26 17:42 - 00000000 ____D () C:\Users\Petra\AppData\Local\{80E23C48-A37A-4792-B79A-3B83034D0E01}
2014-03-26 05:35 - 2014-03-26 05:38 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A5D83DAD-71C9-4E8A-BA6E-7C53EB3ACA9E}
2014-03-25 12:21 - 2014-03-25 12:21 - 00000000 ____D () C:\Program Files (x86)\MUSICSTATION
2014-03-25 06:11 - 2014-03-25 06:14 - 00000000 ____D () C:\Users\Petra\AppData\Local\{61C328C4-249D-4877-8560-8E8CCECA9227}
2014-03-24 18:08 - 2014-03-24 18:11 - 00000000 ____D () C:\Users\Petra\AppData\Local\{74FB9043-9A42-4E3D-A788-8A721870A7AF}
2014-03-24 05:39 - 2014-03-24 05:42 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D435401C-FB2D-4CB0-9F90-E2735B0F28F9}
2014-03-23 13:22 - 2014-03-23 13:25 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C116116D-4E44-4B90-90BB-C3FFAA4CD12B}
2014-03-22 17:55 - 2014-03-22 17:58 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AAC4104E-FB02-44C3-8ACD-7F284DBF2F7F}
2014-03-22 05:51 - 2014-03-22 05:54 - 00000000 ____D () C:\Users\Petra\AppData\Local\{04112698-1E32-41EB-8B2E-DAE6049B2A53}
2014-03-21 17:48 - 2014-03-21 17:51 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EAE5F2A-71EB-4ED8-AB9F-EED812BFFD4F}
2014-03-21 05:44 - 2014-03-21 05:47 - 00000000 ____D () C:\Users\Petra\AppData\Local\{407BE4CC-DAD6-4C09-9E8A-538D32594C35}
2014-03-20 09:02 - 2014-03-20 09:05 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5E283FB0-7017-47A0-9FD2-EB9536A0BED3}
2014-03-19 19:09 - 2014-03-19 19:11 - 00000000 ____D () C:\Users\Petra\AppData\Local\{406CB15E-9C61-448D-8008-E1E2DB130691}
2014-03-19 07:13 - 2014-03-19 07:13 - 00000000 ____D () C:\Users\Petra\AppData\Local\{51CEB430-CF2E-41D2-B2A4-9665796FA529}
2014-03-18 19:09 - 2014-03-18 19:12 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0AC19F75-90D8-475E-9867-E17A4F0480AC}
2014-03-18 06:47 - 2014-03-18 06:50 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3E95A4D4-58B7-42B8-99BF-7420C72BC97F}
2014-03-17 18:43 - 2014-03-17 18:46 - 00000000 ____D () C:\Users\Petra\AppData\Local\{634A55DB-A8C1-44D5-A8D2-F9585E3055FE}
2014-03-17 18:31 - 2014-03-17 18:31 - 00347361 ____H (jhyhbgfred) C:\ProgramData\04AMUZrz.exe
2014-03-17 06:39 - 2014-03-17 06:42 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7B8EA3F9-896F-4B12-8900-A9FBEAB2EE91}
2014-03-16 12:06 - 2014-03-16 12:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{64ACA087-8ADC-4909-9387-F34188ABF39D}
2014-03-15 20:53 - 2014-03-15 20:56 - 00000000 ____D () C:\Users\Petra\AppData\Local\{09E7FFB7-13CC-4EB4-86AD-33C87D8DDF7E}
2014-03-15 08:49 - 2014-03-15 08:52 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0FA830EC-8387-449F-9929-B44B5013A56A}
2014-03-14 09:40 - 2014-03-14 09:43 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0B35DC25-CAEA-43D5-889F-C48DAF54648B}
2014-03-13 18:35 - 2014-03-13 18:38 - 00000000 ____D () C:\Users\Petra\AppData\Local\{DC42BCC5-9F29-45DF-8874-231FE451365A}
2014-03-13 18:07 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 18:07 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 18:07 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 18:07 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 18:07 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 18:07 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 18:07 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 18:07 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 18:07 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 18:07 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 18:07 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 18:07 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 18:07 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 18:07 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 18:07 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 18:07 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 18:07 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 18:07 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 18:07 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 18:07 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 18:07 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 18:07 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 18:07 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 18:07 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 18:07 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 18:07 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 18:07 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 18:07 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 18:07 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 18:07 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 18:07 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 18:07 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 18:07 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 18:07 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 18:07 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 18:07 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 18:07 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 18:07 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 18:07 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 18:07 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 18:07 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 18:07 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 18:07 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 18:07 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 18:05 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 18:05 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 18:05 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 18:05 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-13 06:31 - 2014-03-13 06:34 - 00000000 ____D () C:\Users\Petra\AppData\Local\{47C37DBC-7E56-4596-9251-CD9C158928EA}
2014-03-12 10:09 - 2014-03-12 10:12 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A819A4C9-A03C-420F-9DF4-15E529A60578}
2014-03-11 18:32 - 2014-03-11 18:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0305664C-9CC1-42AC-A47E-061A4B33CEA5}
2014-03-11 06:28 - 2014-03-11 06:31 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4084983C-F694-4287-8B12-7AA4EE7222D8}
2014-03-10 09:50 - 2014-03-10 09:53 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5C113143-1F1C-42D5-891C-7D9D9B48DCE1}
2014-03-09 21:46 - 2014-03-09 21:49 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3568D60B-823D-4421-A6A1-19155E8D8F05}
2014-03-09 08:32 - 2014-03-31 21:10 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForPetra
2014-03-09 08:32 - 2014-03-31 21:10 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForPetra.job
2014-03-09 08:29 - 2014-03-09 08:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C00D78F4-3E9E-421F-9AB9-4EBF560EA72B}
2014-03-08 08:29 - 2014-03-08 08:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6B4533C3-A8B0-4F33-AB1E-F15ABB16320D}
2014-03-07 07:01 - 2014-03-07 07:01 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6DF6ADA9-1C75-4ECC-888D-46043AAE9714}
2014-03-06 19:00 - 2014-03-06 19:00 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6D7853F2-D8F4-4F21-8C45-CFFB2D3D1D00}
2014-03-06 06:59 - 2014-03-06 07:00 - 00000000 ____D () C:\Users\Petra\AppData\Local\{F9825830-298D-4444-BDAA-2B72A40A19F9}
2014-03-05 18:59 - 2014-03-05 18:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D070BF31-46F0-427F-BA6F-56210297253D}
2014-03-05 14:58 - 2014-03-24 11:58 - 00000000 ____D () C:\Users\Petra\Desktop\Zahnersatz
2014-03-05 06:58 - 2014-03-05 06:58 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AF92FE52-2ECB-4CD6-8DE7-8846D47D5A3F}
2014-03-04 14:55 - 2014-03-04 14:56 - 00000000 ____D () C:\Users\Petra\AppData\Local\{125E8B4C-DCBA-4789-A4A5-03D42769ED64}
2014-03-04 02:55 - 2014-03-04 02:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3FB5D01E-8FAB-460A-B344-2273532679F8}

==================== One Month Modified Files and Folders =======

2014-04-03 17:17 - 2014-04-01 17:30 - 00030470 _____ () C:\Users\Petra\Downloads\FRST.txt
2014-04-03 17:16 - 2014-04-01 17:30 - 00000000 ____D () C:\FRST
2014-04-03 17:13 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-03 17:13 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-03 17:12 - 2014-04-03 17:12 - 00119372 _____ () C:\Users\Petra\Desktop\log.xml
2014-04-03 17:12 - 2011-11-09 03:52 - 01106475 _____ () C:\Windows\WindowsUpdate.log
2014-04-03 17:09 - 2014-04-02 19:37 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-04-03 17:08 - 2011-08-09 21:16 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-03 17:08 - 2011-08-09 21:16 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-03 17:08 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-03 17:07 - 2011-12-09 12:02 - 00103176 _____ () C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-03 17:06 - 2013-01-17 07:24 - 00013680 _____ () C:\Users\Petra\AppData\Local\carport.ldc
2014-04-03 17:04 - 2013-12-30 09:23 - 00000926 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
2014-04-03 17:04 - 2013-01-14 12:30 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-04-03 17:04 - 2013-01-09 19:08 - 00000436 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-04-03 17:04 - 2012-02-11 10:50 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-03 17:04 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-03 17:04 - 2009-07-14 05:51 - 00114090 _____ () C:\Windows\setupact.log
2014-04-03 17:04 - 2009-07-14 05:45 - 00413128 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-03 17:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2014-04-03 17:03 - 2010-11-21 04:47 - 00212526 _____ () C:\Windows\PFRO.log
2014-04-03 17:01 - 2013-01-17 12:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-03 16:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-03 16:57 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2014-04-03 16:52 - 2013-12-30 09:23 - 00000292 _____ () C:\Windows\Tasks\SaveSense.job
2014-04-03 16:50 - 2012-02-11 10:50 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-03 16:49 - 2014-04-03 16:46 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7A9B454C-DF17-45FC-97B9-975301CAAB35}
2014-04-03 16:49 - 2012-04-13 11:17 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\SoftGrid Client
2014-04-03 16:46 - 2013-12-30 09:23 - 00000930 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
2014-04-03 04:45 - 2014-04-03 04:42 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1801A9C0-7C1C-4624-8430-8AFFF29ECA7E}
2014-04-02 21:01 - 2014-04-02 21:01 - 00000000 ____D () C:\Users\Petra\Desktop\Virus nicht löschen
2014-04-02 20:26 - 2013-01-29 19:32 - 00000000 ____D () C:\Users\Petra\Documents\Outlook-Dateien
2014-04-02 20:04 - 2014-02-01 12:50 - 00053760 _____ () C:\Users\Petra\Desktop\Einkommen &  Ausgaben.ods
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-04-02 16:40 - 2014-04-02 16:40 - 05192353 _____ (Swearware) C:\Users\Petra\Downloads\ComboFix.exe
2014-04-02 16:27 - 2011-12-12 20:36 - 00000000 ____D () C:\Users\Petra\AppData\Local\Conduit
2014-04-02 10:51 - 2014-04-02 10:48 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7C885690-C00B-441A-AA55-28EE92CC00C7}
2014-04-02 04:45 - 2012-02-11 10:50 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-02 04:45 - 2012-02-11 10:50 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-01 20:59 - 2014-04-01 20:56 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7AFF5624-F2AC-4BA9-AFED-398D71E8F882}
2014-04-01 20:06 - 2013-06-11 20:21 - 00779776 ___SH () C:\Users\Petra\Desktop\Thumbs.db
2014-04-01 17:34 - 2014-04-01 17:32 - 00055412 _____ () C:\Users\Petra\Downloads\Addition.txt
2014-04-01 17:30 - 2014-04-01 17:30 - 02157056 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2014-04-01 08:55 - 2014-04-01 08:52 - 00000000 ____D () C:\Users\Petra\AppData\Local\{410E4AEC-2704-475C-B432-7D5046644CF1}
2014-03-31 21:10 - 2014-03-09 08:32 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForPetra
2014-03-31 21:10 - 2014-03-09 08:32 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForPetra.job
2014-03-31 20:52 - 2014-03-31 20:49 - 00000000 ____D () C:\Users\Petra\AppData\Local\{898FD30F-6CA3-4291-A805-AB6CBF21C21F}
2014-03-31 20:43 - 2011-12-09 11:57 - 00000000 ____D () C:\Users\Petra
2014-03-31 19:40 - 2011-12-09 11:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\Hewlett-Packard
2014-03-31 19:40 - 2011-11-09 04:13 - 00000000 ____D () C:\ProgramData\Norton
2014-03-31 19:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-31 19:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-03-31 15:33 - 2014-03-31 15:30 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EDDE8AB-14DD-42E7-A96F-BCB48E9D5A8F}
2014-03-31 03:46 - 2014-03-31 03:43 - 00000000 ____D () C:\Users\Petra\AppData\Local\{BBE49052-0CD2-4B8A-9263-109708567F16}
2014-03-30 08:59 - 2014-03-30 08:56 - 00000000 ____D () C:\Users\Petra\AppData\Local\{37BA57CF-4BA2-4135-A385-E2FD1193AECE}
2014-03-29 07:48 - 2014-03-29 07:45 - 00000000 ____D () C:\Users\Petra\AppData\Local\{98F6CDF6-F989-46D0-9B3A-8CE763298EEF}
2014-03-28 18:39 - 2014-03-28 18:36 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1A22D96E-DAC9-463B-8AFE-FB6DE38879BB}
2014-03-28 06:35 - 2014-03-28 06:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{EA06B9B3-FFA3-437D-B459-BC5CCF197A6D}
2014-03-27 18:32 - 2014-03-27 18:29 - 00000000 ____D () C:\Users\Petra\AppData\Local\{1DD9E130-B39A-40DD-9638-376B4CF64C6B}
2014-03-27 06:02 - 2014-03-27 05:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4BD105C1-3E5F-431D-A424-68F1BBCFFE37}
2014-03-26 17:42 - 2014-03-26 17:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{80E23C48-A37A-4792-B79A-3B83034D0E01}
2014-03-26 09:56 - 2014-02-25 19:22 - 00000000 ____D () C:\Users\Petra\Desktop\WHOP
2014-03-26 05:38 - 2014-03-26 05:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A5D83DAD-71C9-4E8A-BA6E-7C53EB3ACA9E}
2014-03-25 14:21 - 2013-11-28 19:10 - 00000000 ____D () C:\Users\Petra\Desktop\ARCHIV
2014-03-25 12:21 - 2014-03-25 12:21 - 00000000 ____D () C:\Program Files (x86)\MUSICSTATION
2014-03-25 06:14 - 2014-03-25 06:11 - 00000000 ____D () C:\Users\Petra\AppData\Local\{61C328C4-249D-4877-8560-8E8CCECA9227}
2014-03-25 05:43 - 2013-12-30 13:23 - 00000144 _____ () C:\Users\Petra\AppData\Roaming\WB.CFG
2014-03-24 18:11 - 2014-03-24 18:08 - 00000000 ____D () C:\Users\Petra\AppData\Local\{74FB9043-9A42-4E3D-A788-8A721870A7AF}
2014-03-24 11:58 - 2014-03-05 14:58 - 00000000 ____D () C:\Users\Petra\Desktop\Zahnersatz
2014-03-24 05:42 - 2014-03-24 05:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D435401C-FB2D-4CB0-9F90-E2735B0F28F9}
2014-03-23 13:25 - 2014-03-23 13:22 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C116116D-4E44-4B90-90BB-C3FFAA4CD12B}
2014-03-22 17:58 - 2014-03-22 17:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AAC4104E-FB02-44C3-8ACD-7F284DBF2F7F}
2014-03-22 05:54 - 2014-03-22 05:51 - 00000000 ____D () C:\Users\Petra\AppData\Local\{04112698-1E32-41EB-8B2E-DAE6049B2A53}
2014-03-21 17:51 - 2014-03-21 17:48 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4EAE5F2A-71EB-4ED8-AB9F-EED812BFFD4F}
2014-03-21 05:47 - 2014-03-21 05:44 - 00000000 ____D () C:\Users\Petra\AppData\Local\{407BE4CC-DAD6-4C09-9E8A-538D32594C35}
2014-03-20 09:05 - 2014-03-20 09:02 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5E283FB0-7017-47A0-9FD2-EB9536A0BED3}
2014-03-19 19:11 - 2014-03-19 19:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{406CB15E-9C61-448D-8008-E1E2DB130691}
2014-03-19 07:13 - 2014-03-19 07:13 - 00000000 ____D () C:\Users\Petra\AppData\Local\{51CEB430-CF2E-41D2-B2A4-9665796FA529}
2014-03-18 19:12 - 2014-03-18 19:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0AC19F75-90D8-475E-9867-E17A4F0480AC}
2014-03-18 06:50 - 2014-03-18 06:47 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3E95A4D4-58B7-42B8-99BF-7420C72BC97F}
2014-03-18 03:05 - 2013-07-28 07:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 03:01 - 2011-12-11 10:01 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-17 18:46 - 2014-03-17 18:43 - 00000000 ____D () C:\Users\Petra\AppData\Local\{634A55DB-A8C1-44D5-A8D2-F9585E3055FE}
2014-03-17 18:31 - 2014-03-17 18:31 - 00347361 ____H (jhyhbgfred) C:\ProgramData\04AMUZrz.exe
2014-03-17 06:42 - 2014-03-17 06:39 - 00000000 ____D () C:\Users\Petra\AppData\Local\{7B8EA3F9-896F-4B12-8900-A9FBEAB2EE91}
2014-03-16 12:09 - 2014-03-16 12:06 - 00000000 ____D () C:\Users\Petra\AppData\Local\{64ACA087-8ADC-4909-9387-F34188ABF39D}
2014-03-15 20:56 - 2014-03-15 20:53 - 00000000 ____D () C:\Users\Petra\AppData\Local\{09E7FFB7-13CC-4EB4-86AD-33C87D8DDF7E}
2014-03-15 08:52 - 2014-03-15 08:49 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0FA830EC-8387-449F-9929-B44B5013A56A}
2014-03-14 15:14 - 2012-05-10 02:01 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-14 15:14 - 2012-05-10 02:01 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-14 09:43 - 2014-03-14 09:40 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0B35DC25-CAEA-43D5-889F-C48DAF54648B}
2014-03-13 18:38 - 2014-03-13 18:35 - 00000000 ____D () C:\Users\Petra\AppData\Local\{DC42BCC5-9F29-45DF-8874-231FE451365A}
2014-03-13 06:34 - 2014-03-13 06:31 - 00000000 ____D () C:\Users\Petra\AppData\Local\{47C37DBC-7E56-4596-9251-CD9C158928EA}
2014-03-12 10:12 - 2014-03-12 10:09 - 00000000 ____D () C:\Users\Petra\AppData\Local\{A819A4C9-A03C-420F-9DF4-15E529A60578}
2014-03-11 18:35 - 2014-03-11 18:32 - 00000000 ____D () C:\Users\Petra\AppData\Local\{0305664C-9CC1-42AC-A47E-061A4B33CEA5}
2014-03-11 06:31 - 2014-03-11 06:28 - 00000000 ____D () C:\Users\Petra\AppData\Local\{4084983C-F694-4287-8B12-7AA4EE7222D8}
2014-03-10 09:53 - 2014-03-10 09:50 - 00000000 ____D () C:\Users\Petra\AppData\Local\{5C113143-1F1C-42D5-891C-7D9D9B48DCE1}
2014-03-09 21:49 - 2014-03-09 21:46 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3568D60B-823D-4421-A6A1-19155E8D8F05}
2014-03-09 12:36 - 2011-12-11 10:03 - 00000000 ____D () C:\Users\Petra\AppData\Local\CrashDumps
2014-03-09 08:32 - 2014-03-09 08:29 - 00000000 ____D () C:\Users\Petra\AppData\Local\{C00D78F4-3E9E-421F-9AB9-4EBF560EA72B}
2014-03-08 08:32 - 2014-03-08 08:29 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6B4533C3-A8B0-4F33-AB1E-F15ABB16320D}
2014-03-07 07:01 - 2014-03-07 07:01 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6DF6ADA9-1C75-4ECC-888D-46043AAE9714}
2014-03-06 19:00 - 2014-03-06 19:00 - 00000000 ____D () C:\Users\Petra\AppData\Local\{6D7853F2-D8F4-4F21-8C45-CFFB2D3D1D00}
2014-03-06 07:00 - 2014-03-06 06:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{F9825830-298D-4444-BDAA-2B72A40A19F9}
2014-03-05 18:59 - 2014-03-05 18:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\{D070BF31-46F0-427F-BA6F-56210297253D}
2014-03-05 06:58 - 2014-03-05 06:58 - 00000000 ____D () C:\Users\Petra\AppData\Local\{AF92FE52-2ECB-4CD6-8DE7-8846D47D5A3F}
2014-03-04 14:56 - 2014-03-04 14:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{125E8B4C-DCBA-4789-A4A5-03D42769ED64}
2014-03-04 02:55 - 2014-03-04 02:55 - 00000000 ____D () C:\Users\Petra\AppData\Local\{3FB5D01E-8FAB-460A-B344-2273532679F8}

Files to move or delete:
====================
C:\ProgramData\04AMUZrz.exe


Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\ApnStub.exe
C:\Users\Petra\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Petra\AppData\Local\Temp\Extract.exe
C:\Users\Petra\AppData\Local\Temp\gmx_mediacenter_setup_bundled.exe
C:\Users\Petra\AppData\Local\Temp\GMX_Toolbar_IE_Setup.exe
C:\Users\Petra\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Petra\AppData\Local\Temp\incredibar_installer.exe
C:\Users\Petra\AppData\Local\Temp\installhelper.dll
C:\Users\Petra\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Petra\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Petra\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\MyBabylonTB_google_20120807.exe
C:\Users\Petra\AppData\Local\Temp\nshF78F.tmp.tbPiet.dll
C:\Users\Petra\AppData\Local\Temp\nsw7EB2.tmp.tbPiet.dll
C:\Users\Petra\AppData\Local\Temp\OptimizerPro.exe
C:\Users\Petra\AppData\Local\Temp\ResetDevice.exe
C:\Users\Petra\AppData\Local\Temp\Resource.exe
C:\Users\Petra\AppData\Local\Temp\rtdrvmon.exe
C:\Users\Petra\AppData\Local\Temp\sas.exe
C:\Users\Petra\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\Petra\AppData\Local\Temp\sp54620.exe
C:\Users\Petra\AppData\Local\Temp\SP54714.exe
C:\Users\Petra\AppData\Local\Temp\SP56221.exe
C:\Users\Petra\AppData\Local\Temp\sp58915.exe
C:\Users\Petra\AppData\Local\Temp\SP59202.exe
C:\Users\Petra\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Petra\AppData\Local\Temp\TB_DF9A.exe
C:\Users\Petra\AppData\Local\Temp\Uni000.exe
C:\Users\Petra\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Petra\AppData\Local\Temp\UpdateCheckerSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-31 11:36

==================== End Of Log ============================

--- --- ---

--- --- ---

cosinus · 04.04.2014, 09:31

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

andiausgraz · 05.04.2014, 20:42

Danke, dürfte damit gelöst sein.

Seither kommt kein pop-up Fenster mehr.

Code:

ATTFilter

ComboFix 14-03-24.01 - Petra 04.04.2014  12:44:10.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.43.1031.18.3691.1825 [GMT 1:00]
ausgeführt von:: C:\Users\Petra\Downloads\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))


C:\install.exe
C:\Program Files (x86)\SaveSense
C:\Program Files (x86)\SaveSense\icon.ico
C:\Program Files (x86)\SaveSense\SaveSense.crx
C:\Program Files (x86)\SaveSense\SaveSense.xpi
C:\Program Files (x86)\SaveSense\SaveSenseIE.dll
C:\Program Files (x86)\SaveSense\SaveSenseIE64.dll
C:\Program Files (x86)\SaveSense\SaveSenseUpdateVer.exe
C:\Program Files (x86)\SaveSense\uninst.exe
C:\Program Files (x86)\SaveSenseLive
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdate.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_am.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ar.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bg.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bn.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ca.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_cs.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_da.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_de.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_el.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en-GB.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es-419.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_et.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fa.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fi.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fil.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fr.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_gu.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hi.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hr.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hu.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_id.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_is.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_it.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_iw.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ja.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_kn.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ko.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lt.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lv.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ml.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_mr.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ms.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_nl.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_no.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pl.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-BR.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-PT.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ro.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ru.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sk.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sl.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sr.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sv.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sw.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ta.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_te.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_th.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_tr.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_uk.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ur.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_vi.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-CN.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-TW.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psmachine.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psuser.dll
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHelper.msi
C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe
C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe
C:\ProgramData\04AMUZrz.exe
C:\ProgramData\SaveSenseLive
C:\ProgramData\SaveSenseLive\Update\Log\SaveSenseLive.log
C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense
C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense Help.url
C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense.url
C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\Uninstall SaveSense.lnk
C:\Users\Petra\AppData\Roaming\SaveSense
C:\Users\Petra\AppData\Roaming\SaveSense\UpdateProc\config.dat
C:\Users\Petra\AppData\Roaming\SaveSense\UpdateProc\info.dat
C:\Users\Petra\AppData\Roaming\SaveSense\UpdateProc\STTL.DAT
C:\Users\Petra\AppData\Roaming\SaveSense\UpdateProc\TTL.DAT
C:\Users\Petra\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe


(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_savesenselive
-------\Service_savesenselivem
-------\Service_savesenselivem


(((((((((((((((((((((((   Dateien erstellt von 2014-03-04 bis 2014-04-04  ))))))))))))))))))))))))))))))


2014-04-04 12:00:52 . 2014-04-04 12:00:52	--------	d-----w-	C:\Users\Default\AppData\Local\temp
2014-04-04 08:25:55 . 2014-03-07 04:43:46	10521840	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{10C36B65-5CC6-40F2-BF7E-2CEFE6C6C28D}\mpengine.dll
2014-04-02 18:36:52 . 2014-04-02 18:36:52	--------	d-----w-	C:\Users\Petra\AppData\Roaming\Nico Mak Computing
2014-04-02 18:36:34 . 2014-04-02 18:36:34	--------	d-----w-	C:\ProgramData\Nico Mak Computing
2014-04-02 18:36:32 . 2014-04-02 18:36:35	--------	d-----w-	C:\Program Files (x86)\WinZip Malware Protector
2014-04-02 18:36:32 . 2013-03-15 16:10:46	20480	----a-w-	C:\Windows\system32\wsusnative64.exe
2014-04-01 16:30:50 . 2014-04-03 16:20:31	--------	d-----w-	C:\FRST
2014-03-25 11:21:32 . 2014-03-25 11:21:32	--------	d-----w-	C:\Program Files (x86)\MUSICSTATION
2014-03-13 17:05:22 . 2014-02-04 02:32:12	624128	----a-w-	C:\Windows\system32\qedit.dll
2014-03-13 17:05:22 . 2014-02-04 02:04:11	509440	----a-w-	C:\Windows\SysWow64\qedit.dll
2014-03-13 17:05:20 . 2014-02-04 02:32:22	1424384	----a-w-	C:\Windows\system32\WindowsCodecs.dll
2014-03-13 17:05:20 . 2014-02-04 02:04:22	1230336	----a-w-	C:\Windows\SysWow64\WindowsCodecs.dll
.


((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

2014-03-18 02:01:19 . 2011-12-11 09:01:43	90015360	----a-w-	C:\Windows\system32\MRT.exe


((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))


*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{e5b8f946-64f0-427b-9482-9252c94874c3}"= "C:\Users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll" [2014-03-26 14:19:26 424224]

[HKEY_CLASSES_ROOT\clsid\{e5b8f946-64f0-427b-9482-9252c94874c3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{e5b8f946-64f0-427b-9482-9252c94874c3}]
2014-03-26 14:19:26	424224	----a-w-	C:\Users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{e5b8f946-64f0-427b-9482-9252c94874c3}"= "C:\Users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll" [2014-03-26 14:19:26 424224]

[HKEY_CLASSES_ROOT\clsid\{e5b8f946-64f0-427b-9482-9252c94874c3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVMUSBFernanschluss"="C:\Users\Petra\AppData\Local\Apps\2.0\5LWJ9PB4.9B5\74QNHXGV.TQ8\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\AVMAutoStart.exe" [2012-12-25 18:08:00 139264]
"acSecurityLayer"="C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe" [2013-10-14 08:17:18 3630976]
"BackgroundContainerV2"="C:\Users\Petra\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll" [2014-03-26 14:17:32 325920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 10:07:50 336384]
"HPQuickWebProxy"="C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-28 09:41:08 168504]
"Adobe Reader Speed Launcher"="C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-12-18 18:42:44 40312]
"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 16:57:26 959904]
"HPOSD"="C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-06-13 14:47:12 336440]
"Easybits Recovery"="C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe" [2011-05-17 10:00:00 61112]
"HPConnectionManager"="C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-06-14 16:12:10 103992]
"HP Quick Launch"="C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-02-15 11:58:00 577408]
"MailCheck IE Broker"="C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe" [2013-10-16 22:05:28 1728064]

C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CarPort Updater.lnk - C:\Program Files (x86)\CarPort\CarPort.exe --update [2012-11-20 1577104]
OpenOffice.org 3.4.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
a.sign Client.lnk - C:\Program Files (x86)\A-Trust GmbH\a.sign Client\ASignLauncher.exe [2013-9-30 3350912]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-6-16 1333024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll

cosinus · 06.04.2014, 12:23

Log von CF ist leider unvollständig

andiausgraz · 06.04.2014, 12:31

hmm....

Ich hof ich hab jetzt nichts unterschlagen beim reinkopieren.

Code:

ATTFilter

ComboFix 14-04-05.01 - Petra 05.04.2014  21:48:27.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.43.1031.18.3691.1647 [GMT 1:00]
ausgeführt von:: c:\users\Petra\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
---- Vorheriger Suchlauf -------
.
C:\install.exe
c:\program files (x86)\SaveSense\icon.ico
c:\program files (x86)\SaveSense\SaveSense.crx
c:\program files (x86)\SaveSense\SaveSense.xpi
c:\program files (x86)\SaveSense\SaveSenseIE.dll
c:\program files (x86)\SaveSense\SaveSenseIE64.dll
c:\program files (x86)\SaveSense\SaveSenseUpdateVer.exe
c:\program files (x86)\SaveSense\uninst.exe
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdate.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_am.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ar.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bg.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bn.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ca.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_cs.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_da.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_de.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_el.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en-GB.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es-419.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_et.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fa.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fi.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fil.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_gu.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hi.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hu.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_id.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_is.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_it.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_iw.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ja.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_kn.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ko.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lt.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lv.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ml.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_mr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ms.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_nl.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_no.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pl.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-BR.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-PT.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ro.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ru.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sk.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sl.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sv.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sw.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ta.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_te.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_th.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_tr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_uk.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ur.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_vi.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-CN.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-TW.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\psmachine.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\psuser.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHelper.msi
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe
c:\program files (x86)\SaveSenseLive\Update\SaveSenseLive.exe
c:\programdata\04AMUZrz.exe
c:\programdata\SaveSenseLive\Update\Log\SaveSenseLive.log
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense Help.url
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\SaveSense.url
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense\Uninstall SaveSense.lnk
c:\users\Petra\AppData\Roaming\SaveSense\UpdateProc\config.dat
c:\users\Petra\AppData\Roaming\SaveSense\UpdateProc\info.dat
c:\users\Petra\AppData\Roaming\SaveSense\UpdateProc\STTL.DAT
c:\users\Petra\AppData\Roaming\SaveSense\UpdateProc\TTL.DAT
c:\users\Petra\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_savesenselive
-------\Service_savesenselivem
-------\Service_savesenselivem
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-05 bis 2014-04-05  ))))))))))))))))))))))))))))))
.
.
2014-04-05 21:12 . 2014-04-05 21:12	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-04-05 11:29 . 2014-04-05 11:31	--------	d-----w-	c:\users\Petra\AppData\Roaming\Dropbox
2014-04-05 11:29 . 2014-04-05 11:29	--------	d-----w-	c:\users\Petra\AppData\Roaming\AVAST Software
2014-04-05 11:24 . 2014-04-05 11:23	84816	----a-w-	c:\windows\system32\drivers\aswStm.sys
2014-04-05 11:24 . 2014-04-05 11:23	208928	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-04-05 11:24 . 2014-04-05 11:23	423240	----a-w-	c:\windows\system32\drivers\aswSP.sys
2014-04-05 11:24 . 2014-04-05 11:23	1039096	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-04-05 11:24 . 2014-04-05 11:23	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-04-05 11:24 . 2014-04-05 11:23	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-04-05 11:24 . 2014-04-05 11:23	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-04-05 11:24 . 2014-04-05 11:23	334648	----a-w-	c:\windows\system32\aswBoot.exe
2014-04-05 11:23 . 2014-04-05 11:23	43152	----a-w-	c:\windows\avastSS.scr
2014-04-05 11:22 . 2014-04-05 11:22	--------	d-----w-	c:\program files\AVAST Software
2014-04-05 11:20 . 2014-04-05 11:20	--------	d-----w-	c:\programdata\AVAST Software
2014-04-05 11:13 . 2014-04-05 20:44	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{10C36B65-5CC6-40F2-BF7E-2CEFE6C6C28D}\offreg.dll
2014-04-04 08:25 . 2014-03-07 04:43	10521840	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{10C36B65-5CC6-40F2-BF7E-2CEFE6C6C28D}\mpengine.dll
2014-04-02 18:36 . 2014-04-02 18:36	--------	d-----w-	c:\users\Petra\AppData\Roaming\Nico Mak Computing
2014-04-02 18:36 . 2014-04-02 18:36	--------	d-----w-	c:\programdata\Nico Mak Computing
2014-04-02 18:36 . 2014-04-02 18:36	--------	d-----w-	c:\program files (x86)\WinZip Malware Protector
2014-04-02 18:36 . 2013-03-15 16:10	20480	----a-w-	c:\windows\system32\wsusnative64.exe
2014-04-01 16:30 . 2014-04-03 16:20	--------	d-----w-	C:\FRST
2014-03-25 11:21 . 2014-03-25 11:21	--------	d-----w-	c:\program files (x86)\MUSICSTATION
2014-03-13 17:05 . 2014-02-04 02:32	624128	----a-w-	c:\windows\system32\qedit.dll
2014-03-13 17:05 . 2014-02-04 02:04	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-03-13 17:05 . 2014-02-04 02:32	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-03-13 17:05 . 2014-02-04 02:04	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-18 02:01 . 2011-12-11 09:01	90015360	----a-w-	c:\windows\system32\MRT.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{e5b8f946-64f0-427b-9482-9252c94874c3}"= "c:\users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll" [2014-03-26 424224]
.
[HKEY_CLASSES_ROOT\clsid\{e5b8f946-64f0-427b-9482-9252c94874c3}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{0f21b1e5-5afc-43c9-9c66-515046e92ec2}]
c:\program files (x86)\SaveSense\SaveSenseIE.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{e5b8f946-64f0-427b-9482-9252c94874c3}]
2014-03-26 14:19	424224	----a-w-	c:\users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{e5b8f946-64f0-427b-9482-9252c94874c3}"= "c:\users\Petra\AppData\LocalLow\Pietro_Style\prxtbPie1.dll" [2014-03-26 424224]
.
[HKEY_CLASSES_ROOT\clsid\{e5b8f946-64f0-427b-9482-9252c94874c3}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"acSecurityLayer"="c:\program files (x86)\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe" [2013-10-14 3630976]
"04AMUZrz"="c:\programdata\04AMUZrz.exe" [BU]
"BackgroundContainerV2"="c:\users\Petra\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll" [2014-03-26 325920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-28 168504]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-12-18 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-06-13 336440]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-05-17 61112]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-06-14 103992]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-02-15 577408]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-04-05 3854640]
.
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CarPort Updater.lnk - c:\program files (x86)\CarPort\CarPort.exe --update [2012-11-20 1577104]
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
a.sign Client.lnk - c:\program files (x86)\A-Trust GmbH\a.sign Client\ASignLauncher.exe [2013-9-30 3350912]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-6-16 1333024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 AndNetDiag2;LGE AndroidNet For Diagnostics Port;c:\windows\system32\DRIVERS\lgandnetdiag264.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag264.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys;c:\windows\SYSNATIVE\DRIVERS\avmaudio.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 GemCCID;GemCCID;c:\windows\system32\DRIVERS\GemCCID.sys;c:\windows\SYSNATIVE\DRIVERS\GemCCID.sys [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1309010.00E\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1309010.00E\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1309010.00E\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1309010.00E\SYMEFA64.SYS [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20110519.002\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20110519.002\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1309010.00E\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20110519.031\IDSVia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20110519.031\IDSVia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1309010.00E\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1309010.00E\SYMNETS.SYS [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 KMService;KMService;c:\windows\system32\srvany.exe;c:\windows\SYSNATIVE\srvany.exe [x]
S2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe;c:\windows\SYSNATIVE\lxbkcoms.exe [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 avmaura;AVM USB-Fernanschluss;c:\windows\system32\DRIVERS\avmaura.sys;c:\windows\SYSNATIVE\DRIVERS\avmaura.sys [x]
S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
S3 btwampfl;btwampfl;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
S3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-15 17:54	1150280	----a-w-	c:\program files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11 09:50]
.
2014-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11 09:50]
.
2014-04-04 c:\windows\Tasks\HPCeeScheduleForPetra.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-05 11:23	290888	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Petra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-09-15 7466600]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-27 42808]
"lxbkbmgr.exe"="c:\program files (x86)\Lexmark X1100 Series\lxbkbmgr.exe" [2008-02-28 74408]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.at/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Mit FRITZ!Box Anrufen - c:\program files (x86)\FRITZ!Box\AddOn (IE)\fb_addon_dial_ie.htm
IE: Mit FRITZ!Box Anrufen\Contexts - 16 (0x10)
IE: Mit FRITZ!Box Anrufen\Flags
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{328ECD19-C167-40eb-A0C7-16FE7634105F} - {CC68A724-B5F7-4bd3-865C-7D97141A140F} - c:\program files (x86)\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{EC2B092F-C5B9-4040-B032-8CE2E80D7E70}: DhcpNameServer = 192.168.1.1 192.168.1.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-10 - (no file)
WebBrowser-{E5B8F946-64F0-427B-9482-9252C94874C3} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
AddRemove-SaveSense - c:\users\Petra\AppData\Roaming\SAVESE~1\UpdateProc\UpdateTask.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-05  22:20:19
ComboFix-quarantined-files.txt  2014-04-05 21:20
.
Vor Suchlauf: 20 Verzeichnis(se), 410.093.686.784 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 409.830.334.464 Bytes frei
.
- - End Of File - - D624B10DB8AEA1F915AD439A2F960B5B
A36C5E4F47E84449FF07ED3517B43A31

cosinus · 06.04.2014, 12:33

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

andiausgraz · 06.04.2014, 13:42

Ok also zuerst die AdwCleaner(S0)

Code:

ATTFilter

# AdwCleaner v3.023 - Bericht erstellt am 06/04/2014 um 13:40:19
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Petra - WOHNZIMMER
# Gestartet von : C:\Users\Petra\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\iLivid
Ordner Gelöscht : C:\Program Files (x86)\Inbox Toolbar
[x] Nicht Gelöscht : C:\Program Files (x86)\Pietro_Style
Ordner Gelöscht : C:\Users\Petra\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Petra\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Petra\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Petra\AppData\Local\SaveSenseLive
Ordner Gelöscht : C:\Users\Petra\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Petra\AppData\LocalLow\Inbox Toolbar
Ordner Gelöscht : C:\Users\Petra\AppData\LocalLow\PriceGong
[x] Nicht Gelöscht : C:\Users\Petra\AppData\LocalLow\Pietro_Style
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\user.js

***** [ Verknüpfungen ] *****

dann AdwCleaner(S1)

Code:

ATTFilter

# AdwCleaner v3.023 - Bericht erstellt am 06/04/2014 um 13:44:42
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Petra - WOHNZIMMER
# Gestartet von : C:\Users\Petra\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Pietro_Style
Ordner Gelöscht : C:\Users\Petra\AppData\LocalLow\Pietro_Style

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduitapps.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ilivid
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\inbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=3
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=9
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3010202
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_total-commander_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_total-commander_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E5B8F946-64F0-427B-9482-9252C94874C3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E884528C-DD0E-41AF-8224-E8028E1DF25C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E5B8F946-64F0-427B-9482-9252C94874C3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E5B8F946-64F0-427B-9482-9252C94874C3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E884528C-DD0E-41AF-8224-E8028E1DF25C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E5B8F946-64F0-427B-9482-9252C94874C3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E884528C-DD0E-41AF-8224-E8028E1DF25C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E147C8EB-36C0-408F-8D3F-0AF410CF6B64}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E5B8F946-64F0-427B-9482-9252C94874C3}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E5B8F946-64F0-427B-9482-9252C94874C3}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D3D233D5-9F6D-436C-B6C7-E63F77503B30}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E5B8F946-64F0-427B-9482-9252C94874C3}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{E5B8F946-64F0-427B-9482-9252C94874C3}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Inbox Toolbar
Schlüssel Gelöscht : HKCU\Software\SaveSenseLive
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Pietro_Style
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainer
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Pietro_Style
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DealPlyLive
Schlüssel Gelöscht : HKLM\Software\IB Updater
Schlüssel Gelöscht : HKLM\Software\ilivid
Schlüssel Gelöscht : HKLM\Software\Inbox Toolbar
Schlüssel Gelöscht : HKLM\Software\SaveSenseLive
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Pietro_Style
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ilivid
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Pietro_Style Toolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\IB Updater

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521


-\\ Google Chrome v33.0.1750.154

[ Datei : C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [14556 octets] - [06/04/2014 13:37:28]
AdwCleaner[R1].txt - [13435 octets] - [06/04/2014 13:41:19]
AdwCleaner[S0].txt - [1285 octets] - [06/04/2014 13:40:19]
AdwCleaner[S1].txt - [12117 octets] - [06/04/2014 13:44:42]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [12178 octets] ##########

dann FRST

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Petra (administrator) on WOHNZIMMER on 06-04-2014 14:26:03
Running from C:\Users\Petra\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(CANON INC.) C:\Program Files\Canon\DIAS\CnxDIAS.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
() C:\Windows\SysWOW64\srvany.exe
( ) C:\Windows\system32\lxbkcoms.exe
() C:\Windows\KMService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7466600 2011-09-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2821416 2011-08-20] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [lxbkbmgr.exe] - C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmgr.exe [74408 2008-02-28] (Lexmark International, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [336440 2011-06-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-06-14] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-05] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [acSecurityLayer] - C:\Program Files (x86)\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe [3630976 2013-10-14] (A-Trust Gesellschaft für Sicherheitssysteme im elektronischen Datenverkehr GmbH)
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [04AMUZrz] - C:\ProgramData\04AMUZrz.exe
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Run: [BackgroundContainerV2] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Petra\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3867768323-361688634-2235168212-1001\...\Policies\system: [DisableChangePassword] 0
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CarPort Updater.lnk
ShortcutTarget: CarPort Updater.lnk -> C:\Program Files (x86)\CarPort\CarPort.exe ()
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = 
SearchScopes: HKLM - {8262B94D-0FB8-44AE-AA96-7114154C01C3} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {2A157E4D-7060-4D28-8A0A-ED2D12A4ACB7} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {680D9B3B-9675-45E7-9B40-36A20BA5FF07} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {74968B32-3D01-494B-AF3F-6D130788E863} URL = hxxp://go.gmx.at/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {9A208462-F53D-40C5-95F4-C38379F53BB4} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: FRITZ!Box Addon BHO - {C0C86BBE-9509-4296-8459-FDBFDAF4B673} - C:\Program Files (x86)\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - No Name - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - No Name - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} -  No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect121.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-08-09] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.at/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U37) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\Petra\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
CHR Plugin: (Java Deployment Toolkit 6.0.370.6) - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-29]
CHR Extension: (Google Drive) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-29]
CHR Extension: (YouTube) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-29]
CHR Extension: (Google-Suche) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-29]
CHR Extension: (avast! Online Security) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-05]
CHR Extension: (Norton Identity Protection) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-03-29]
CHR Extension: (Google Wallet) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]
CHR Extension: (Google Mail) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-29]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-05]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\Exts\Chrome.crx [2013-02-05]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-05] (AVAST Software)
R2 Canon Driver Information Assist Service; C:\Program Files\Canon\DIAS\CnxDIAS.exe [4940760 2012-09-04] (CANON INC.)
R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] ()
R2 lxbk_device; C:\Windows\system32\lxbkcoms.exe [565928 2008-02-19] ( )
R2 lxbk_device; C:\Windows\SysWOW64\lxbkcoms.exe [537256 2008-02-19] ( )
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2013-04-18] (LG Electronics Inc.)
S3 AndNetDiag2; C:\Windows\System32\DRIVERS\lgandnetdiag264.sys [29696 2013-04-18] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2013-06-28] (LG Electronics Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-05] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-05] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-05] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-05] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-05] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-05] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-05] ()
S3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2011-12-09] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2012-12-25] (AVM Berlin)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [133160 2011-06-16] (Broadcom Corporation.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20110519.002\BHDrvx64.sys [1143416 2011-05-13] (Symantec Corporation)
R3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2011-05-21] (Broadcom Corporation.)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1309010.00E\ccSetx64.sys [167072 2012-06-07] (Symantec Corporation)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [216576 2009-09-04] (Huawei Technologies Co., Ltd.)
S3 GemCCID; C:\Windows\System32\DRIVERS\GemCCID.sys [129792 2013-04-24] (Gemalto)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114560 2009-07-24] (Huawei Technologies Co., Ltd.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20110519.031\IDSVia64.sys [488056 2011-05-13] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20110519.002\ENG64.SYS [117880 2011-05-19] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\VirusDefs\20110519.002\EX64.SYS [2011768 2011-05-19] (Symantec Corporation)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1309010.00E\SRTSP64.SYS [737952 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1309010.00E\SRTSPX64.SYS [37536 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMDS64.SYS [451192 2011-05-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1309010.00E\SYMEFA64.SYS [1129120 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-03-27] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1309010.00E\Ironx64.SYS [190072 2012-04-18] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1309010.00E\SYMNETS.SYS [405624 2012-04-18] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-06 14:24 - 2014-04-06 14:24 - 00210312 _____ () C:\Users\Petra\Desktop\JRT.txt
2014-04-06 14:02 - 2014-04-06 13:44 - 00012295 _____ () C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2014-04-06 14:02 - 2014-04-06 13:40 - 00001285 _____ () C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2014-04-06 13:58 - 2014-04-06 13:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-06 13:56 - 2014-04-06 13:57 - 01016261 _____ (Thisisu) C:\Users\Petra\Downloads\JRT (1).exe
2014-04-06 13:37 - 2014-04-06 13:44 - 00000000 ____D () C:\AdwCleaner
2014-04-06 13:35 - 2014-04-06 13:36 - 01426178 _____ () C:\Users\Petra\Downloads\adwcleaner.exe
2014-04-05 22:20 - 2014-04-05 22:20 - 00032635 _____ () C:\ComboFix.txt
2014-04-05 12:31 - 2014-04-05 12:31 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\DropboxMaster
2014-04-05 12:30 - 2014-04-05 12:30 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-05 12:29 - 2014-04-05 12:31 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Dropbox
2014-04-05 12:29 - 2014-04-05 12:29 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\AVAST Software
2014-04-05 12:25 - 2014-04-05 12:29 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-05 12:24 - 2014-04-05 12:23 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-05 12:24 - 2014-04-05 12:23 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-05 12:24 - 2014-04-05 12:23 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-05 12:24 - 2014-04-05 12:23 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-05 12:24 - 2014-04-05 12:23 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-05 12:24 - 2014-04-05 12:23 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-05 12:24 - 2014-04-05 12:23 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-05 12:24 - 2014-04-05 12:23 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-05 12:23 - 2014-04-05 12:23 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-05 12:22 - 2014-04-05 12:22 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-05 12:20 - 2014-04-05 12:20 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-05 12:17 - 2014-04-05 12:20 - 88551496 _____ (AVAST Software) C:\Users\Petra\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-04 20:10 - 2014-04-04 20:10 - 00178151 _____ () C:\Users\Petra\Documents\cookies.txt
2014-04-04 20:10 - 2014-04-04 20:10 - 00008588 _____ () C:\Users\Petra\Documents\bookmark.htm
2014-04-04 20:10 - 2014-04-04 20:10 - 00000236 _____ () C:\Users\Petra\Documents\feeds.opml
2014-04-04 12:40 - 2014-04-05 22:20 - 00000000 ____D () C:\Qoobox
2014-04-04 12:40 - 2014-04-04 15:26 - 00000000 ____D () C:\Windows\erdnt
2014-04-04 12:40 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-04 12:40 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-04 12:40 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-04 12:40 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-04 12:40 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-04 12:40 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-04 12:40 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-04 12:40 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-02 19:37 - 2014-04-06 13:57 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-04-02 19:36 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-04-01 17:32 - 2014-04-03 17:20 - 00048514 _____ () C:\Users\Petra\Downloads\Addition.txt
2014-04-01 17:30 - 2014-04-06 14:26 - 00021980 _____ () C:\Users\Petra\Downloads\FRST.txt
2014-04-01 17:30 - 2014-04-06 14:26 - 00000000 ____D () C:\FRST
2014-04-01 17:30 - 2014-04-01 17:30 - 02157056 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2014-03-25 12:21 - 2014-03-25 12:21 - 00000000 ____D () C:\Program Files (x86)\MUSICSTATION
2014-03-13 18:07 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 18:07 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 18:07 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 18:07 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 18:07 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 18:07 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 18:07 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 18:07 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 18:07 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 18:07 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 18:07 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 18:07 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 18:07 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 18:07 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 18:07 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 18:07 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 18:07 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 18:07 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 18:07 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 18:07 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 18:07 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 18:07 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 18:07 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 18:07 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 18:07 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 18:07 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 18:07 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 18:07 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 18:07 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 18:07 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 18:07 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 18:07 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 18:07 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 18:07 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 18:07 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 18:07 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 18:07 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 18:07 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 18:07 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 18:07 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 18:07 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 18:07 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 18:07 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 18:07 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 18:05 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 18:05 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 18:05 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 18:05 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-09 08:32 - 2014-04-04 21:10 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForPetra
2014-03-09 08:32 - 2014-04-04 21:10 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForPetra.job

==================== One Month Modified Files and Folders =======

2014-04-06 14:26 - 2014-04-01 17:30 - 00021980 _____ () C:\Users\Petra\Downloads\FRST.txt
2014-04-06 14:26 - 2014-04-01 17:30 - 00000000 ____D () C:\FRST
2014-04-06 14:24 - 2014-04-06 14:24 - 00210312 _____ () C:\Users\Petra\Desktop\JRT.txt
2014-04-06 13:58 - 2014-04-06 13:58 - 00000000 ____D () C:\Windows\ERUNT
2014-04-06 13:58 - 2011-11-09 03:52 - 01187164 _____ () C:\Windows\WindowsUpdate.log
2014-04-06 13:57 - 2014-04-06 13:56 - 01016261 _____ (Thisisu) C:\Users\Petra\Downloads\JRT (1).exe
2014-04-06 13:57 - 2014-04-02 19:37 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-04-06 13:55 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-06 13:55 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-06 13:54 - 2011-08-09 21:16 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-06 13:54 - 2011-08-09 21:16 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-06 13:54 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-06 13:50 - 2013-01-17 07:24 - 00013680 _____ () C:\Users\Petra\AppData\Local\carport.ldc
2014-04-06 13:50 - 2012-02-11 10:50 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-06 13:50 - 2012-02-11 10:50 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-06 13:47 - 2013-01-14 12:30 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-04-06 13:47 - 2013-01-09 19:08 - 00000437 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-04-06 13:47 - 2010-11-21 04:47 - 00215844 _____ () C:\Windows\PFRO.log
2014-04-06 13:47 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-06 13:47 - 2009-07-14 05:51 - 00114482 _____ () C:\Windows\setupact.log
2014-04-06 13:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2014-04-06 13:44 - 2014-04-06 14:02 - 00012295 _____ () C:\Users\Petra\Desktop\AdwCleaner[S1].txt
2014-04-06 13:44 - 2014-04-06 13:37 - 00000000 ____D () C:\AdwCleaner
2014-04-06 13:40 - 2014-04-06 14:02 - 00001285 _____ () C:\Users\Petra\Desktop\AdwCleaner[S0].txt
2014-04-06 13:40 - 2013-01-19 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-06 13:36 - 2014-04-06 13:35 - 01426178 _____ () C:\Users\Petra\Downloads\adwcleaner.exe
2014-04-05 22:20 - 2014-04-05 22:20 - 00032635 _____ () C:\ComboFix.txt
2014-04-05 22:20 - 2014-04-04 12:40 - 00000000 ____D () C:\Qoobox
2014-04-05 22:20 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-04-05 22:12 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-05 13:46 - 2011-12-09 12:25 - 00015999 _____ () C:\Windows\avmacc.log
2014-04-05 13:45 - 2011-12-09 13:03 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
2014-04-05 13:45 - 2011-12-09 12:22 - 00000000 ____D () C:\Users\Petra\AppData\Local\Deployment
2014-04-05 12:31 - 2014-04-05 12:31 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\DropboxMaster
2014-04-05 12:31 - 2014-04-05 12:29 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Dropbox
2014-04-05 12:30 - 2014-04-05 12:30 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-05 12:29 - 2014-04-05 12:29 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\AVAST Software
2014-04-05 12:29 - 2014-04-05 12:25 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-05 12:23 - 2014-04-05 12:24 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-05 12:23 - 2014-04-05 12:24 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-05 12:23 - 2014-04-05 12:24 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-05 12:23 - 2014-04-05 12:24 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-05 12:23 - 2014-04-05 12:24 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-05 12:23 - 2014-04-05 12:24 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-05 12:23 - 2014-04-05 12:24 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-05 12:23 - 2014-04-05 12:24 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-05 12:23 - 2014-04-05 12:23 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-05 12:22 - 2014-04-05 12:22 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-05 12:20 - 2014-04-05 12:20 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-05 12:20 - 2014-04-05 12:17 - 88551496 _____ (AVAST Software) C:\Users\Petra\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-04 21:10 - 2014-03-09 08:32 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForPetra
2014-04-04 21:10 - 2014-03-09 08:32 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForPetra.job
2014-04-04 20:58 - 2014-02-01 12:50 - 00053760 _____ () C:\Users\Petra\Desktop\Einkommen &  Ausgaben.ods
2014-04-04 20:10 - 2014-04-04 20:10 - 00178151 _____ () C:\Users\Petra\Documents\cookies.txt
2014-04-04 20:10 - 2014-04-04 20:10 - 00008588 _____ () C:\Users\Petra\Documents\bookmark.htm
2014-04-04 20:10 - 2014-04-04 20:10 - 00000236 _____ () C:\Users\Petra\Documents\feeds.opml
2014-04-04 19:39 - 2013-11-28 19:10 - 00000000 ____D () C:\Users\Petra\Desktop\ARCHIV
2014-04-04 18:34 - 2013-06-11 20:21 - 00788480 ___SH () C:\Users\Petra\Desktop\Thumbs.db
2014-04-04 15:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-04 15:29 - 2011-12-09 12:22 - 00000000 ____D () C:\Users\Petra\AppData\Local\Apps\2.0
2014-04-04 15:26 - 2014-04-04 12:40 - 00000000 ____D () C:\Windows\erdnt
2014-04-04 15:11 - 2009-07-14 03:34 - 74973184 _____ () C:\Windows\system32\config\software.bak
2014-04-04 15:11 - 2009-07-14 03:34 - 18087936 _____ () C:\Windows\system32\config\system.bak
2014-04-04 15:11 - 2009-07-14 03:34 - 00524288 _____ () C:\Windows\system32\config\default.bak
2014-04-04 15:11 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-04-04 15:11 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-04-03 17:20 - 2014-04-01 17:32 - 00048514 _____ () C:\Users\Petra\Downloads\Addition.txt
2014-04-03 17:07 - 2011-12-09 12:02 - 00103176 _____ () C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-03 17:04 - 2009-07-14 05:45 - 00413128 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-03 17:01 - 2013-01-17 12:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-03 16:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-03 16:57 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2014-04-03 16:49 - 2012-04-13 11:17 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\SoftGrid Client
2014-04-02 20:26 - 2013-01-29 19:32 - 00000000 ____D () C:\Users\Petra\Documents\Outlook-Dateien
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-04-02 19:36 - 2014-04-02 19:36 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-04-02 04:45 - 2012-02-11 10:50 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-02 04:45 - 2012-02-11 10:50 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-01 17:30 - 2014-04-01 17:30 - 02157056 _____ (Farbar) C:\Users\Petra\Downloads\FRST64.exe
2014-03-31 20:43 - 2011-12-09 11:57 - 00000000 ____D () C:\Users\Petra
2014-03-31 19:40 - 2011-12-09 11:59 - 00000000 ____D () C:\Users\Petra\AppData\Local\Hewlett-Packard
2014-03-31 19:40 - 2011-11-09 04:13 - 00000000 ____D () C:\ProgramData\Norton
2014-03-31 19:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-03-26 09:56 - 2014-02-25 19:22 - 00000000 ____D () C:\Users\Petra\Desktop\WHOP
2014-03-25 12:21 - 2014-03-25 12:21 - 00000000 ____D () C:\Program Files (x86)\MUSICSTATION
2014-03-25 05:43 - 2013-12-30 13:23 - 00000144 _____ () C:\Users\Petra\AppData\Roaming\WB.CFG
2014-03-24 11:58 - 2014-03-05 14:58 - 00000000 ____D () C:\Users\Petra\Desktop\Zahnersatz
2014-03-18 03:05 - 2013-07-28 07:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 03:01 - 2011-12-11 10:01 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-14 15:14 - 2012-05-10 02:01 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-14 15:14 - 2012-05-10 02:01 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-09 12:36 - 2011-12-11 10:03 - 00000000 ____D () C:\Users\Petra\AppData\Local\CrashDumps

Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\Quarantine.exe
C:\Users\Petra\AppData\Local\Temp\rtdrvmon.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-31 11:36

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

dann Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Petra at 2014-04-06 14:27:47
Running from C:\Users\Petra\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

a.sign Bürgerkartensoftware 1.4.3.1 (HKLM-x32\...\a.sign Bürgerkartensoftware) (Version: 1.4.3.1 - A-Trust GmbH)
a.sign Client 1.3.2.11 (HKLM-x32\...\a.sign Client) (Version: 1.3.2.11 - A-Trust GmbH)
a.sign PDF 1.11.10.6 (HKLM-x32\...\a.sign PDF) (Version: 1.11.10.6 - A-Trust)
A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version:  - mobilkom austria AG)
A1 Dashboard (x32 Version: 1.8.0.151 - mobilkom austria AG) Hidden
Adobe Flash Player 11 ActiveX 64-bit (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.5.502.110 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD APP SDK Runtime (Version: 2.4.650.9 - Advanced Micro Devices Inc.) Hidden
AMD Fuel (Version: 2011.0705.1115.18310 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.60705.1113 - ATI Technologies Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0705.1115.18310 - Ihr Firmenname) Hidden
asignPDFverify 1.0.9.0 (HKLM-x32\...\asignPDFverify) (Version: 1.0.9.0 - A-Trust)
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2016 - Avast Software)
AVM FRITZ!Box AddOn (IE) (HKLM-x32\...\{CEAD06D8-D033-4D2A-9328-AF49089E129F}) (Version: 1.7.0 - AVM Berlin)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.100.82.86 - Broadcom Corporation)
Broadcom Bluetooth Software (HKLM\...\{6E7F4CA3-B2DE-413C-A7A1-43AA5BE19EA1}) (Version: 6.5.0.1300 - Broadcom Corporation)
Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.1.1300 - Broadcom Corporation)
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Canon Font Manager (HKLM-x32\...\InstallShield_{BFF1B295-2565-4DF4-B999-9600C8665814}) (Version: 1.00.0000 - Monotype Imaging)
Canon Font Manager (x32 Version: 1.00.0000 - Monotype Imaging) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0705.1115.18310 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0705.1115.18310 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0705.1115.18310 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help English (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help French (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help German (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0705.1114.18310 - ATI) Hidden
ccc-utility64 (Version: 2011.0705.1115.18310 - ATI) Hidden
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.1.4119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Deinst. f. Druckertreiber UFR II (HKLM\...\Canon UFR II Printer Driver) (Version: 5, 4, 0, 0 - Canon Inc.)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.24 - Dropbox, Inc.)
Elsword_DE (HKLM-x32\...\Elsword_DE_is1) (Version:  - )
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
FRITZ!Box USB-Fernanschluss - 1  (HKCU\...\2db37667170956ee) (Version: 2.3.2.0 - AVM Berlin)
FRITZ!Box USB-Fernanschluss (HKCU\...\f018cf21c0452c64) (Version: 2.3.0.2 - AVM Berlin)
GMX Desktop Icons (HKLM-x32\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.0.21 - 1&1 Mail & Media GmbH)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Connection Manager (HKLM-x32\...\{5E63C0AB-19B0-47D4-842E-6B324EB0614B}) (Version: 4.1.23.1 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{68A55875-B6DD-41E8-8CF6-F193D9C47051}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{D7670221-BF9B-4DFF-B26B-5BE55A87329F}) (Version: 1.2.2 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{8B52057C-15DB-433E-957C-E279BC7D07E3}) (Version: 3.1.0.9742 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
Java(TM) 6 Update 37 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.370 - Oracle)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kundendienste Online 2.0.0.6 (HKLM-x32\...\Kundendienste Online) (Version: 2.0.0.6 - A-Trust GmbH)
Lexmark X1100 Series (HKLM\...\Lexmark X1100 Series) (Version:  - Lexmark International, Inc.)
LG PC Suite (HKLM-x32\...\LG PC Suite) (Version: 5.3.14.20140117 - LG Electronics)
LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Software Update for Web Folders  (German) 14 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Norton Internet Security (HKLM-x32\...\NIS) (Version: 19.9.1.14 - Symantec Corporation)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6461 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.21.0 - Synaptics Incorporated)
Total Commander (Remove or Repair) (HKLM-x32\...\Totalcmd) (Version: 7.56a - Ghisler Software GmbH)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VCDS PCI 11.11 (HKLM-x32\...\VCDS PCI) (Version: PCI 11.11 - PCI Diagnosetechnik GmbH & Co. KG)
VCDS-Lite 1.1 (HKLM-x32\...\VCDS-Lite  1.1) (Version: 1.1 - Ross-Tech)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.36 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - FTDI FTDI D2XX (03/21/2011 2.08.14) (HKLM\...\D6BC3CBE8968CB6351105F9D2EEC52CE24F2C99D) (Version: 03/21/2011 2.08.14 - FTDI)
Windows-Treiberpaket - FTDI FTDI VCP (03/20/2011 2.08.14) (HKLM\...\9FCA89337DAC5D4196D98BF2F17E831E1EE83336) (Version: 03/20/2011 2.08.14 - FTDI)
Windows-Treiberpaket - MPP USB CDC Virtual COM Port (09/16/2011 1.5.0) (HKLM\...\6D3D1B84986E536339ED6F2B2A381D13597CD69C) (Version: 09/16/2011 1.5.0 - MPP)
Windows-Treiberpaket - Ross-Tech USB Driver Package (06/16/2010 2.06.02) (HKLM\...\F2D626F9A8E5C6126BED6EBD3E3504D0B2AB8443) (Version: 06/16/2010 2.06.02 - Ross-Tech)
WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10798 - WinZip International LLC)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Restore Points  =========================

14-03-2014 08:41:59 Windows Update
18-03-2014 02:00:14 Windows Update
21-03-2014 06:36:30 Windows Update
25-03-2014 13:21:25 Windows Update
29-03-2014 06:59:20 Windows Update
31-03-2014 14:16:49 Wiederherstellungsvorgang
31-03-2014 14:35:11 Windows Update
31-03-2014 18:33:24 Wiederherstellungsvorgang
31-03-2014 19:53:42 Windows Update
03-04-2014 15:49:46 Microsoft Office Klick-und-Los 2010 wird entfernt
03-04-2014 15:51:59 Microsoft Office 2010 wird entfernt
03-04-2014 15:53:50 Removed Microsoft Office Home and Business 2010
04-04-2014 08:24:02 Windows Update
05-04-2014 11:21:12 avast! antivirus system restore point

==================== Hosts content: ==========================

2009-07-14 03:34 - 2014-04-05 22:12 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0B01F23A-EE91-42A4-AFAF-7D9BFC267F8E} - System32\Tasks\{E127C60C-FE1C-4EF2-9470-AB24530DCFB0} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {0D479EDB-4EC3-4635-BC25-2D9A1D3C2095} - System32\Tasks\{074B3F8F-2C94-4392-96B3-81F290A0EDF8} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {133210FC-7CA9-4D1C-BBA4-DB963267C18E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11] (Google Inc.)
Task: {18EF5738-FBCD-47BA-B357-53EC744BDB3D} - System32\Tasks\{0A60719A-A881-43DC-83E3-0B6221D4E062} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {240EF86B-5EC7-4272-890B-E805A3DF3E4B} - System32\Tasks\{3E7E5D69-276B-4C48-9024-3575F0B58D40} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {3440DFB3-8298-4967-BA2D-2CD16BC91FBA} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\WSCStub.exe [2013-02-02] (Symantec Corporation)
Task: {3DB40D5B-244B-4F30-AB60-F3135F2AFB20} - System32\Tasks\{D082E33C-88A5-4580-9033-5CB36C50880F} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {429458FB-A6AC-4588-BF27-1C1AA7F52DAD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-02-11] (Google Inc.)
Task: {48D0B488-EC46-4308-AB03-5FBBEDB9FC88} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-05] (AVAST Software)
Task: {4A25F6C5-F5BF-4141-AB72-54659010EAC2} - System32\Tasks\{01BDE0CA-8E94-419D-8B58-CC7D7AFAF5D1} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {4DD2D458-DDEB-408F-9B73-CA08C0FAC88B} - System32\Tasks\{EEBC4047-8894-467E-B7D1-3620F049C20D} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {584FB204-B139-4920-8523-C156495314D2} - System32\Tasks\HPCeeScheduleForPetra => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {58579AA2-852D-4D3F-94D7-51FC03F56F5A} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {66C64DBF-1108-4EB5-9CEC-809743ED6C5B} - System32\Tasks\{57524BE1-7C34-47D2-9ACD-1E9ACE7C0053} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {6C1672BB-0DA5-47AF-8515-DBC2E254A915} - System32\Tasks\{6794C280-FF5A-457D-96DD-9C0A28A9BA23} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {784C0C1B-840C-4420-A79B-33961BBF428F} - System32\Tasks\{E6BFF561-0BE9-4438-9B9E-161FDBE71697} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {78E130BE-603A-4C16-875B-85E38E8147B0} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {7FD261C3-869C-4594-A9AA-1A0D6853D724} - System32\Tasks\{6A335AC3-D24A-47E5-AEED-CBE6C337F233} => C:\Users\Petra\Downloads\comport\ComPortMan\ComPortMan.exe [2013-01-14] (Uwe Sieber - www.uwe-sieber.de)
Task: {9B25CE7D-DEC0-4440-8EC6-24791BD98EF1} - System32\Tasks\{705006BC-1C0C-4FFC-8F8C-D067283032F8} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {9D62E63B-426A-4074-9020-92F3155489E3} - System32\Tasks\{533D0D77-5CEF-4D3A-A351-92AB6276631D} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {9EA4CDB6-BEB0-4552-85AF-D372F29A4017} - System32\Tasks\{7CA38709-3138-4B5F-8107-97396C909E2B} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {A3E218D2-63EF-4729-BE84-9FBF37ED460C} - System32\Tasks\{73B0981E-660E-4EA0-8DE2-F9E06AA84E5C} => C:\Program Files (x86)\Microsoft Office\Options14\MSOO.EXE
Task: {AF34E210-8687-4AC5-BFBD-91D6D2E3692E} - System32\Tasks\{7A0B4CD7-5FD5-4E54-8D3C-FCB892A1E235} => C:\Users\Petra\Desktop\Auto Diagnose\auto3\Software\VWTool bis Windows XP\Setup.exe
Task: {C6D22691-5E5A-4458-B252-37F8494F5240} - System32\Tasks\{2FF47835-EDC5-4376-A145-76579C2A2B15} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {CD129565-94DB-4A23-8860-9CAE378E38DB} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {D393C5C7-33E6-4346-B635-727A2B69339D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {D84AC053-9E87-4E82-B84D-EB9B1326727B} - System32\Tasks\{A7ED017B-DF13-47E0-83FE-3DD5BA226DDC} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {DED7FC1F-EBD1-4265-92C0-8930228036F6} - System32\Tasks\{5915D1F3-8440-4E1B-A310-6B6F123A2699} => C:\Program Files (x86)\VAG-COM311\VAG-COM311DE.exe
Task: {DF08D6E9-D0C2-4CA3-96EF-765DA42E1C3C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {E1D89132-254A-4ADA-A61D-885598792C42} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\SymErr.exe [2012-02-04] (Symantec Corporation)
Task: {F09C4B2B-AF46-4CFE-99CF-575D5CC3EBAB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForPetra.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2011-07-05 11:27 - 2011-07-05 11:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-16 18:57 - 2011-06-16 18:57 - 00081696 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\BtwLeLib.dll
2013-01-17 11:52 - 2003-04-18 19:06 - 00008192 _____ () C:\Windows\SysWOW64\srvany.exe
2013-01-17 11:52 - 2010-04-10 09:03 - 00077824 _____ () C:\Windows\KMService.exe
2005-09-13 16:27 - 2005-09-13 16:27 - 00054784 _____ () C:\Windows\system32\lxbkcnv5.dll
2011-07-05 11:27 - 2011-07-05 11:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 11:13 - 2011-07-05 11:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-04-06 11:24 - 2014-04-06 11:24 - 02189824 _____ () C:\Program Files\AVAST Software\Avast\defs\14040600\algo.dll
2014-04-05 12:23 - 2014-04-05 12:23 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: USB-Verbundgerät
Description: USB-Verbundgerät
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: usbccgp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-04-05 22:10:53.523
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-05 22:10:52.778
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-05 22:10:52.033
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-05 22:10:51.290
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-04 12:59:06.876
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-04 12:59:06.392
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:31:34.658
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:31:34.549
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:00:41.155
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-01-16 07:00:41.046
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\avmaudio.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 3690.91 MB
Available physical RAM: 2177.63 MB
Total Pagefile: 7379.99 MB
Available Pagefile: 5532.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:446.09 GB) (Free:381.5 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.51 GB) (Free:1.69 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32
Drive g: (A1) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS
Drive h: (MICROSD2GB) (Removable) (Total:1.91 GB) (Free:0.48 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F2DC90A7)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

andiausgraz · 06.04.2014, 13:45

zu guter letzt noch

JRT ist zu gross kann ich leider nur als Zip anhängen.

cosinus · 06.04.2014, 23:48

Logs nicht anhängen, immer direkt posten, notfalls über mehrere Beiträge verteile posten

06.04.2014, 12:23	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	netupdater.exe Log von CF ist leider unvollständig __________________ Logfiles bitte immer in CODE-Tags posten

06.04.2014, 23:48	#15
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	netupdater.exe Logs nicht anhängen, immer direkt posten, notfalls über mehrere Beiträge verteile posten __________________ Logfiles bitte immer in CODE-Tags posten

netupdater.exe

Plagegeister aller Art und deren Bekämpfung: netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

netupdater.exe

Ähnliche Themen: netupdater.exe

02.04.2014, 03:50	#3
andiausgraz	netupdater.exe Hallo und liebe grüße. Ich hab die beiden Dateien in Den Anhang gestellt. Ich hoff du kommst damit zurecht? __________________

06.04.2014, 13:45	#14
andiausgraz	netupdater.exe zu guter letzt noch JRT ist zu gross kann ich leider nur als Zip anhängen.