Hilfe - mein Browser spielt verrückt.
Es öffnen sich die ganze Zeit PopUps, meine Startseite verändert sich und es öffnen sich permanent neue Werbeseiten, die aussehen wie von bekannten Anbietern. Ich kann leider mit dem HJT logfile nichts anfangen. Antivir und Spybot habe ich schon mein ges System scannen lassen. Alle Probleme gelöscht, nur ändert sich leider nichts. Daher nochmal: HILFE!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:34:45, on 13.06.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17126)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\raving reyven\bin\ravingreyven.BrowserAdapter.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Meriem\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: raving reyven - {0f866026-a8bb-42a7-987f-2f92715a8147} - C:\Program Files (x86)\raving reyven\19979DEE-381E-4E29-AFD2-7EDD249A4033.dll
O2 - BHO: CrossriderApp0058360 - {11111111-1111-1111-1111-110511831160} - C:\Program Files (x86)\HD-V1.3\HD-V1.3-bho.dll
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll
O2 - BHO: AMD SteadyVideo BHO - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe
O4 - HKLM\..\Run: [EnergyCut] C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Download Protect] C:\ProgramData\dlprotect.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [AppEx Accelerator UI] C:\Program Files\AMD Quick Stream\AMDQuickStream.exe -h
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Meriem\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O20 - AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~1.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Echtzeit-Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: Download Protect Service (DlProtectSvc) - Unknown owner - C:\Windows\System32\DlProtectSvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: globalUpdate Update Service (globalUpdate) (globalUpdate) - globalUpdate - C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: globalUpdate Update Service (globalUpdatem) (globalUpdatem) - globalUpdate - C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: IePlugin Services (IePluginServices) - Cherished Technololgy LIMITED - C:\ProgramData\IePluginServices\PluginService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NewPlayer Updater Service (NewPlayerUpdaterService) - Unknown owner - C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update raving reyven - Unknown owner - C:\Program Files (x86)\raving reyven\updateravingreyven.exe
O23 - Service: Util raving reyven - Unknown owner - C:\Program Files (x86)\raving reyven\bin\utilravingreyven.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WindowsProtectManger Service (WindowsProtectManger) - Fuyu LIMITED - C:\ProgramData\WindowsProtectManger\wprotectmanager.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: exFAT avgntflt UMBusenumerator-Treiber (xcopy64) - Unknown owner - C:\Windows\system32\PerfCfnterCPL.exe (file missing)

--
End of file - 12001 bytes

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:

• Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
• Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
• Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
  Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
• Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
• Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!





Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

ich wollte das soeben tun, leider kam bei hjt eine fehlermeldung, habe es als adminisrator ausgeführt, funktioniert wieder nicht, habe es neu installiert, alles wiederholt und leider kann ich immer noch keinen logfile abspeichern. wie soll ich jetzt vorgehen?

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:02:31, on 13.06.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17126)
Boot mode: Normal

Running processes:
C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
C:\ProgramData\dlprotect.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Meriem\Downloads\hijackthis_5833.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: CrossriderApp0058360 - {11111111-1111-1111-1111-110511831160} - C:\Program Files (x86)\HD-V1.3\HD-V1.3-bho.dll (file missing)
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll
O2 - BHO: AMD SteadyVideo BHO - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe
O4 - HKLM\..\Run: [EnergyCut] C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Download Protect] C:\ProgramData\dlprotect.exe
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [AppEx Accelerator UI] C:\Program Files\AMD Quick Stream\AMDQuickStream.exe -h
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Meriem\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O20 - AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~1.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Echtzeit-Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: Download Protect Service (DlProtectSvc) - Unknown owner - C:\Windows\System32\DlProtectSvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: IePlugin Services (IePluginServices) - Cherished Technololgy LIMITED - C:\ProgramData\IePluginServices\PluginService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: exFAT avgntflt UMBusenumerator-Treiber (xcopy64) - Unknown owner - C:\Windows\system32\PerfCfnterCPL.exe (file missing)

--
End of file - 10923 bytes
         

offensichtlich hat es geklappt...

meinst du mit farbars tune up? als ich auf den link geklickt hab, kam nämlich tune up dabei raus... oder stell ich mich grad etwas blöd an? ich damit jetzt einen scan durchgeführt u alles behoben

Zitat von meriberi

meinst du mit farbars tune up? als ich auf den link geklickt hab, kam nämlich tune up dabei raus... oder stell ich mich grad etwas blöd an? ich damit jetzt einen scan durchgeführt u alles behoben

Ich meine Farbar's Recovery Scan Tool... du hast auf Werbung geklickt... und wahrscheinlich jetzt noch mehr Mist auf deinem Rechner wie vorher...

In der Regel dauert es ein paar Sekunden, bis der Download steht ("Download wird vorbereitet").

Ok,ich werde morgen abend das Ergebnis reinstellen,da ich übers WE unterwegs bin. Ich hoffe,ich überstrapaziere deine Geduld nicht. Vielen Dank schonmal f deine Mühe u bitte um Verständnis für alle Unwissenden

Du strapazierst meine Geduld nicht, keine Sorge.

ok, der wahnsinn ich hab's geschafft:
FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-06-2014
Ran by Meriem (administrator) on MERIEM-PC on 15-06-2014 22:20:02
Running from C:\Users\Meriem\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AMDQuickStream.exe
(Spotify Ltd) C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Windows\System32\DlProtectSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
() C:\ProgramData\dlprotect.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
() C:\Windows\System32\PerfCfnterCPL.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6346464 2013-01-04] (Realtek semiconductor)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2014-04-19] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2014-04-19] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe [1581056 2007-04-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [EnergyCut] => C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe [1167360 2007-03-09] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [182352 2014-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Download Protect] => C:\ProgramData\dlprotect.exe [12800 2014-06-12] ()
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [429792 2013-02-08] (AppEx Networks Corporation)
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [Spotify Web Helper] => C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-28] (Spotify Ltd)
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\MountPoints2: {55141ddc-c7e3-11e3-ac07-8211742138cb} - E:\wubi.exe
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\MountPoints2: {e26e12c6-c8ae-11e3-a547-a9957f8366c2} - F:\iLinker.exe
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\Program Files (x86)\SupTab\SearchProtect64.dll [102512 2014-05-08] (Skytech Co., Ltd.)
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => C:\Program Files (x86)\SupTab\SearchProtect32.dll [91248 2014-05-08] (Skytech Co., Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = WebSearches
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = WebSearches
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = WebSearches
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = WebSearches
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = WebSearches
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = WebSearches
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: HD-V1.3 - {11111111-1111-1111-1111-110511831160} -  No File
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.1.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Meriem\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File

Chrome: 
=======
CHR StartupUrls: "https://ixquick.de/"
CHR DefaultSearchKeyword: ixquick.com
CHR DefaultSearchProvider: Ixquick HTTPS - Deutsch
CHR DefaultSearchURL: https://ixquick.com/do/search?query={searchTerms}&cat=web&pl=chrome&language=deutsch
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-13]
CHR Extension: (Google Drive) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-13]
CHR Extension: (YouTube) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-13]
CHR Extension: (Google-Suche) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-13]
CHR Extension: (Google Wallet) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-13]
CHR Extension: (Google Mail) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-13]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-06-13]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-22] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [124496 2014-05-05] (Avira Operations GmbH & Co. KG)
R2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [123392 2014-06-12] () [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2140984 2014-04-15] (TuneUp Software)
R2 xcopy64; C:\Windows\system32\PerfCfnterCPL.exe [119296 2014-06-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [217824 2013-03-21] (AppEx Networks Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-19] (Disc Soft Ltd)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-06-03] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-04] (Realtek Semiconductor Corp.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-03-26] (TuneUp Software)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-06-09] (StdLib)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-15 22:20 - 2014-06-15 22:22 - 00015468 _____ () C:\Users\Meriem\Downloads\FRST.txt
2014-06-15 22:19 - 2014-06-15 22:20 - 00000000 ____D () C:\FRST
2014-06-15 22:19 - 2014-06-15 22:19 - 02081280 _____ (Farbar) C:\Users\Meriem\Downloads\FRST64.exe
2014-06-13 19:56 - 2014-06-13 19:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-06-13 19:43 - 2014-06-13 19:43 - 00002213 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002205 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002193 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-06-13 19:43 - 2014-04-15 15:59 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2014-06-13 19:43 - 2014-04-15 15:59 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2014-06-13 19:43 - 2014-04-15 15:59 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2014-06-13 19:42 - 2014-06-13 19:43 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\TuneUp Software
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Local\TuneUp Software
2014-06-13 19:41 - 2014-06-13 19:48 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-13 19:41 - 2014-06-13 19:41 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-13 19:39 - 2014-06-13 19:40 - 27883432 _____ (TuneUp Software) C:\Users\Meriem\Downloads\TuneUpUtilities2014_de-DE.exe
2014-06-13 19:01 - 2014-06-13 19:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Meriem\Downloads\hijackthis_5833.exe
2014-06-13 18:23 - 2014-06-13 18:23 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-13 18:23 - 2014-06-13 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-13 18:21 - 2014-06-15 21:27 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 18:21 - 2014-06-15 19:05 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 18:21 - 2014-06-13 18:21 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-13 18:21 - 2014-06-13 18:21 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-13 18:17 - 2014-06-13 18:17 - 00918672 _____ (Google Inc.) C:\Users\Meriem\Downloads\ChromeSetup.exe
2014-06-13 17:34 - 2014-06-13 19:02 - 00010925 _____ () C:\Users\Meriem\Downloads\hijackthis.log
2014-06-13 12:04 - 2009-06-10 23:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20140613-120430.backup
2014-06-13 01:29 - 2014-06-13 01:29 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-13 01:28 - 2014-06-13 12:01 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-13 01:28 - 2014-06-13 01:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-13 01:28 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-06-13 01:23 - 2014-06-13 01:25 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Meriem\Downloads\spybot-2.3.exe
2014-06-13 01:20 - 2014-06-13 01:20 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Meriem\Downloads\SpyHunter-Installer (2).exe
2014-06-13 00:51 - 2014-06-13 18:12 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-13 00:51 - 2014-06-13 00:51 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\SupTab
2014-06-13 00:51 - 2014-06-13 00:51 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-13 00:51 - 2014-06-13 00:51 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-06-13 00:50 - 2014-06-13 00:50 - 00000000 ____D () C:\Program Files\003
2014-06-12 23:03 - 2014-06-09 12:10 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-06-12 22:02 - 2014-06-12 22:02 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Skype
2014-06-12 22:01 - 2014-06-13 00:04 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-06-12 22:00 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Skype
2014-06-12 21:59 - 2014-06-12 21:59 - 00123392 _____ () C:\Windows\system32\DlProtectSvc.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-06-12 21:57 - 2014-06-13 18:56 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-06-12 21:57 - 2014-06-12 21:57 - 00000000 ____D () C:\Users\Meriem\AppData\Local\globalUpdate
2014-06-12 21:56 - 2014-06-12 21:56 - 00469376 _____ () C:\Users\Meriem\Downloads\skype.exe
2014-06-11 02:05 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 02:05 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 02:05 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 02:05 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 02:05 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 02:05 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 02:05 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 02:05 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 02:05 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 02:05 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 02:05 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 02:05 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 02:05 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 02:05 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 02:05 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 02:05 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 02:05 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 02:05 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 02:05 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 02:05 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 02:05 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 02:05 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-11 02:05 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 02:05 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-11 02:05 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-11 02:05 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 02:05 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 02:05 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 02:05 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-11 02:05 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 02:05 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 02:05 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-11 02:05 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-11 02:05 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 02:05 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 02:05 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-11 02:05 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-11 02:05 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-11 02:05 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 02:05 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-11 02:05 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-11 02:05 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 02:05 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 02:05 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-11 02:05 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-11 02:05 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 02:05 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 02:05 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 02:05 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 02:05 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 02:05 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 02:05 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 02:05 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 02:05 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 02:05 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 02:05 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 02:05 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 02:05 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 02:05 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 02:05 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 02:05 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 02:05 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-11 02:05 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-11 02:05 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 02:03 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 02:03 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 02:44 - 2014-06-06 02:45 - 00000000 ____D () C:\Users\Meriem\Desktop\Darbuka_files
2014-06-06 02:44 - 2014-06-06 02:44 - 00080355 _____ () C:\Users\Meriem\Desktop\Darbuka.htm
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Mnemosyne
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\.matplotlib
2014-06-05 14:33 - 2014-06-05 14:34 - 25784542 _____ ( ) C:\Users\Meriem\Downloads\mnemosyne-2.3-setup.exe
2014-06-05 14:27 - 2014-06-05 14:27 - 00000000 _____ () C:\Users\Meriem\Downloads\memorylifter_21362.exe
2014-06-03 03:03 - 2014-06-03 03:03 - 00038799 _____ () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest.htm
2014-06-03 03:03 - 2014-06-03 03:03 - 00000000 ____D () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest_files
2014-06-03 01:59 - 2014-06-03 02:00 - 09437951 _____ () C:\Users\Meriem\Downloads\krone-scheibenmaeher.wmv
2014-05-28 23:38 - 2014-05-28 23:38 - 00000000 ____D () C:\Users\Meriem\AppData\Local\com
2014-05-28 23:36 - 2014-06-03 00:25 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Activeris
2014-05-28 23:34 - 2014-06-11 11:02 - 00000000 ____D () C:\Program Files (x86)\Re-markit-soft
2014-05-28 23:33 - 2014-05-28 23:33 - 00809488 _____ () C:\Users\Meriem\Downloads\Player_Setup.exe
2014-05-28 18:43 - 2014-05-28 18:43 - 00501248 _____ (Facebook Inc.) C:\Users\Meriem\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
2014-05-28 00:11 - 2014-06-03 00:16 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Spotify
2014-05-28 00:11 - 2014-05-28 00:11 - 00001811 _____ () C:\Users\Meriem\Desktop\Spotify.lnk
2014-05-28 00:11 - 2014-05-28 00:11 - 00001797 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-05-28 00:09 - 2014-06-03 21:07 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Spotify
2014-05-28 00:09 - 2014-05-28 00:09 - 00126112 _____ (Spotify Ltd) C:\Users\Meriem\Downloads\SpotifySetup_0.9.10.14.exe
2014-05-25 13:13 - 2014-05-25 13:13 - 00000000 ____D () C:\Program Files (x86)\ShowMyPCService
2014-05-25 13:09 - 2014-05-25 13:10 - 02146552 _____ () C:\Users\Meriem\Desktop\ShowMyPC3160.exe
2014-05-25 02:36 - 2014-05-25 02:36 - 01095461 _____ (pendrivelinux.com) C:\Users\Meriem\Downloads\Universal-USB-Installer-1.9.5.2.exe
2014-05-25 02:34 - 2014-05-25 02:45 - 957349888 ____R () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso
2014-05-25 02:34 - 2014-05-25 02:34 - 00036747 _____ () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso.torrent
2014-05-25 02:15 - 2014-05-25 02:16 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-05-25 02:15 - 2014-05-25 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2014-05-25 02:15 - 2013-03-21 12:21 - 00217824 _____ (AppEx Networks Corporation) C:\Windows\system32\Drivers\appexDrv.sys
2014-05-25 02:15 - 2012-08-28 20:27 - 00058536 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2014-05-25 02:06 - 2014-05-25 02:06 - 00000000 ____D () C:\Windows\SysWOW64\sda
2014-05-25 02:04 - 2013-01-15 17:37 - 09889352 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsUVStoricon.dll
2014-05-25 02:04 - 2013-01-15 17:37 - 00327240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsUVStor.sys
2014-05-25 02:03 - 2014-05-25 02:07 - 445336096 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\avga141w7.exe
2014-05-25 02:03 - 2014-05-25 02:03 - 06450792 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\cr159w7.exe
2014-05-25 01:58 - 2014-05-25 01:59 - 00000000 ____D () C:\Program Files (x86)\LinuxLive USB Creator
2014-05-25 01:58 - 2014-05-25 01:58 - 04999949 _____ (LinuxLive USB Creator) C:\Users\Meriem\Downloads\LinuxLive_USB_Creator_2.8.28.exe
2014-05-25 01:58 - 2014-05-25 01:58 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LinuxLive USB Creator
2014-05-25 01:33 - 2014-05-25 01:33 - 00000183 _____ () C:\Users\Meriem\Downloads\130827_rockenheim_tenaciousd_fes.mov
2014-05-25 01:22 - 2014-06-06 13:43 - 00000000 ____D () C:\Users\Meriem\Desktop\krims
2014-05-25 00:49 - 2014-05-25 00:49 - 00000000 ____D () C:\Users\Meriem\Downloads\The Lego Movie (2014) BLU-RAY [Heartbleed]
2014-05-25 00:17 - 2014-05-25 00:33 - 1010827264 _____ () C:\Users\Meriem\Downloads\ubuntu-14.04-desktop-amd64.iso
2014-05-22 13:48 - 2014-05-22 23:29 - 00000000 ____D () C:\AdwCleaner
2014-05-22 13:48 - 2014-05-22 13:48 - 01326389 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.210.exe
2014-05-22 13:16 - 2014-05-22 13:17 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86.zip
2014-05-22 13:16 - 2014-05-22 13:17 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86 (1).zip
2014-05-22 02:43 - 2014-05-22 02:43 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-05-18 14:54 - 2014-05-18 14:54 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 14:54 - 2014-05-18 14:54 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-18 14:53 - 2014-05-18 14:53 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-18 14:52 - 2014-05-18 14:57 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-18 14:50 - 2014-05-18 14:56 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Adobe
2014-05-18 14:45 - 2014-05-18 14:45 - 00022792 _____ () C:\Users\Meriem\Desktop\Fragen + Antworten Skript.odt
2014-05-17 23:03 - 2014-05-17 23:03 - 05597688 _____ (Uniblue Systems Ltd ) C:\Users\Meriem\Downloads\driverscanner.exe
2014-05-17 22:45 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-17 22:42 - 2014-05-17 22:42 - 01325827 _____ () C:\Users\Meriem\Downloads\adwcleaner08 (2).exe
2014-05-16 17:27 - 2014-06-10 22:34 - 00000000 ____D () C:\Users\Meriem\Desktop\UNI
2014-05-16 01:17 - 2014-05-16 01:17 - 409233544 _____ () C:\Windows\MEMORY.DMP
2014-05-16 01:17 - 2014-05-16 01:17 - 00276480 _____ () C:\Windows\Minidump\051614-28267-01.dmp
2014-05-16 01:17 - 2014-05-16 01:17 - 00000000 ____D () C:\Windows\Minidump
2014-05-16 01:12 - 2014-06-11 03:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-16 01:12 - 2014-06-11 03:09 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== One Month Modified Files and Folders =======

2014-06-15 22:23 - 2014-04-20 00:00 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Temp
2014-06-15 22:22 - 2014-06-15 22:20 - 00015468 _____ () C:\Users\Meriem\Downloads\FRST.txt
2014-06-15 22:20 - 2014-06-15 22:19 - 00000000 ____D () C:\FRST
2014-06-15 22:19 - 2014-06-15 22:19 - 02081280 _____ (Farbar) C:\Users\Meriem\Downloads\FRST64.exe
2014-06-15 22:18 - 2014-04-19 23:31 - 01229505 _____ () C:\Windows\WindowsUpdate.log
2014-06-15 22:12 - 2009-07-14 06:51 - 00043888 _____ () C:\Windows\setupact.log
2014-06-15 21:51 - 2014-04-19 18:53 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-06-15 21:27 - 2014-06-13 18:21 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-15 19:05 - 2014-06-13 18:21 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-15 18:49 - 2011-04-12 09:43 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-06-15 18:49 - 2011-04-12 09:43 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-06-15 18:49 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-15 16:24 - 2014-04-20 00:00 - 00000000 ____D () C:\Users\Meriem\AppData\Local\VirtualStore
2014-06-13 19:56 - 2014-06-13 19:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-06-13 19:48 - 2014-06-13 19:41 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-13 19:43 - 2014-06-13 19:43 - 00002213 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002205 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002193 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-06-13 19:43 - 2014-06-13 19:42 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\TuneUp Software
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Local\TuneUp Software
2014-06-13 19:41 - 2014-06-13 19:41 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-13 19:40 - 2014-06-13 19:39 - 27883432 _____ (TuneUp Software) C:\Users\Meriem\Downloads\TuneUpUtilities2014_de-DE.exe
2014-06-13 19:02 - 2014-06-13 17:34 - 00010925 _____ () C:\Users\Meriem\Downloads\hijackthis.log
2014-06-13 19:01 - 2014-06-13 19:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Meriem\Downloads\hijackthis_5833.exe
2014-06-13 18:56 - 2014-06-12 21:57 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-06-13 18:23 - 2014-06-13 18:23 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-13 18:23 - 2014-06-13 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-13 18:21 - 2014-06-13 18:21 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-13 18:21 - 2014-06-13 18:21 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-13 18:21 - 2014-04-20 00:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-13 18:20 - 2010-11-21 05:47 - 00260182 _____ () C:\Windows\PFRO.log
2014-06-13 18:20 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-13 18:17 - 2014-06-13 18:17 - 00918672 _____ (Google Inc.) C:\Users\Meriem\Downloads\ChromeSetup.exe
2014-06-13 18:12 - 2014-06-13 00:51 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-13 18:11 - 2014-04-20 00:01 - 00000997 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-13 12:01 - 2014-06-13 01:28 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-13 01:30 - 2014-06-13 01:28 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-13 01:29 - 2014-06-13 01:29 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-13 01:25 - 2014-06-13 01:23 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Meriem\Downloads\spybot-2.3.exe
2014-06-13 01:20 - 2014-06-13 01:20 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Meriem\Downloads\SpyHunter-Installer (2).exe
2014-06-13 00:51 - 2014-06-13 00:51 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\SupTab
2014-06-13 00:51 - 2014-06-13 00:51 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-13 00:51 - 2014-06-13 00:51 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-06-13 00:50 - 2014-06-13 00:50 - 00000000 ____D () C:\Program Files\003
2014-06-13 00:26 - 2009-07-14 04:34 - 00000580 _____ () C:\Windows\win.ini
2014-06-13 00:04 - 2014-06-12 22:01 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Skype
2014-06-13 00:03 - 2009-07-14 06:45 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-13 00:03 - 2009-07-14 06:45 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 22:02 - 2014-06-12 22:02 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-06-12 22:01 - 2014-06-12 22:00 - 00000000 ____D () C:\ProgramData\Skype
2014-06-12 21:59 - 2014-06-12 21:59 - 00123392 _____ () C:\Windows\system32\DlProtectSvc.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-06-12 21:57 - 2014-06-12 21:57 - 00000000 ____D () C:\Users\Meriem\AppData\Local\globalUpdate
2014-06-12 21:56 - 2014-06-12 21:56 - 00469376 _____ () C:\Users\Meriem\Downloads\skype.exe
2014-06-11 11:02 - 2014-05-28 23:34 - 00000000 ____D () C:\Program Files (x86)\Re-markit-soft
2014-06-11 03:12 - 2014-05-16 01:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 03:09 - 2014-05-16 01:12 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 03:09 - 2014-04-20 15:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 03:03 - 2014-05-07 00:59 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 22:34 - 2014-05-16 17:27 - 00000000 ____D () C:\Users\Meriem\Desktop\UNI
2014-06-09 12:10 - 2014-06-12 23:03 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-06-08 11:13 - 2014-06-11 02:03 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 02:03 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 13:56 - 2014-05-07 21:10 - 00000000 ____D () C:\Users\Meriem\Desktop\PICS
2014-06-06 13:43 - 2014-05-25 01:22 - 00000000 ____D () C:\Users\Meriem\Desktop\krims
2014-06-06 02:45 - 2014-06-06 02:44 - 00000000 ____D () C:\Users\Meriem\Desktop\Darbuka_files
2014-06-06 02:44 - 2014-06-06 02:44 - 00080355 _____ () C:\Users\Meriem\Desktop\Darbuka.htm
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Mnemosyne
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\.matplotlib
2014-06-05 14:39 - 2014-04-20 00:00 - 00000000 ____D () C:\Users\Meriem
2014-06-05 14:34 - 2014-06-05 14:33 - 25784542 _____ ( ) C:\Users\Meriem\Downloads\mnemosyne-2.3-setup.exe
2014-06-05 14:27 - 2014-06-05 14:27 - 00000000 _____ () C:\Users\Meriem\Downloads\memorylifter_21362.exe
2014-06-03 21:07 - 2014-05-28 00:09 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Spotify
2014-06-03 03:03 - 2014-06-03 03:03 - 00038799 _____ () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest.htm
2014-06-03 03:03 - 2014-06-03 03:03 - 00000000 ____D () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest_files
2014-06-03 02:00 - 2014-06-03 01:59 - 09437951 _____ () C:\Users\Meriem\Downloads\krone-scheibenmaeher.wmv
2014-06-03 00:27 - 2014-04-20 00:01 - 00000000 ___RD () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-03 00:25 - 2014-05-28 23:36 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Activeris
2014-06-03 00:20 - 2014-05-15 20:45 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-03 00:16 - 2014-05-28 00:11 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Spotify
2014-05-30 12:21 - 2014-06-11 02:05 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 12:02 - 2014-06-11 02:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 12:02 - 2014-06-11 02:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 11:45 - 2014-06-11 02:05 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 11:39 - 2014-06-11 02:05 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 11:39 - 2014-06-11 02:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 11:38 - 2014-06-11 02:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 11:28 - 2014-06-11 02:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 11:27 - 2014-06-11 02:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 11:24 - 2014-06-11 02:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 11:21 - 2014-06-11 02:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 11:21 - 2014-06-11 02:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 11:20 - 2014-06-11 02:05 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 11:18 - 2014-06-11 02:05 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-30 11:11 - 2014-06-11 02:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 11:08 - 2014-06-11 02:05 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 11:06 - 2014-06-11 02:05 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 11:02 - 2014-06-11 02:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-30 10:55 - 2014-06-11 02:05 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:49 - 2014-06-11 02:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:46 - 2014-06-11 02:05 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:44 - 2014-06-11 02:05 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-30 10:44 - 2014-06-11 02:05 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 10:43 - 2014-06-11 02:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-30 10:42 - 2014-06-11 02:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-11 02:05 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-30 10:35 - 2014-06-11 02:05 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 10:34 - 2014-06-11 02:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-30 10:33 - 2014-06-11 02:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-30 10:30 - 2014-06-11 02:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-30 10:29 - 2014-06-11 02:05 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 10:28 - 2014-06-11 02:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-30 10:27 - 2014-06-11 02:05 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-30 10:24 - 2014-06-11 02:05 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 10:23 - 2014-06-11 02:05 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 10:16 - 2014-06-11 02:05 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-30 10:10 - 2014-06-11 02:05 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-11 02:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-30 10:04 - 2014-06-11 02:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-30 10:02 - 2014-06-11 02:05 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-30 09:56 - 2014-06-11 02:05 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-30 09:56 - 2014-06-11 02:05 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:54 - 2014-06-11 02:05 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-30 09:50 - 2014-06-11 02:05 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-11 02:05 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-30 09:43 - 2014-06-11 02:05 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:40 - 2014-06-11 02:05 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-30 09:30 - 2014-06-11 02:05 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:21 - 2014-06-11 02:05 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-30 09:15 - 2014-06-11 02:05 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-30 09:13 - 2014-06-11 02:05 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 09:13 - 2014-06-11 02:05 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-28 23:38 - 2014-05-28 23:38 - 00000000 ____D () C:\Users\Meriem\AppData\Local\com
2014-05-28 23:33 - 2014-05-28 23:33 - 00809488 _____ () C:\Users\Meriem\Downloads\Player_Setup.exe
2014-05-28 18:43 - 2014-05-28 18:43 - 00501248 _____ (Facebook Inc.) C:\Users\Meriem\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
2014-05-28 00:11 - 2014-05-28 00:11 - 00001811 _____ () C:\Users\Meriem\Desktop\Spotify.lnk
2014-05-28 00:11 - 2014-05-28 00:11 - 00001797 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-05-28 00:09 - 2014-05-28 00:09 - 00126112 _____ (Spotify Ltd) C:\Users\Meriem\Downloads\SpotifySetup_0.9.10.14.exe
2014-05-25 13:13 - 2014-05-25 13:13 - 00000000 ____D () C:\Program Files (x86)\ShowMyPCService
2014-05-25 13:10 - 2014-05-25 13:09 - 02146552 _____ () C:\Users\Meriem\Desktop\ShowMyPC3160.exe
2014-05-25 02:45 - 2014-05-25 02:34 - 957349888 ____R () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso
2014-05-25 02:45 - 2014-04-20 15:03 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\uTorrent
2014-05-25 02:36 - 2014-05-25 02:36 - 01095461 _____ (pendrivelinux.com) C:\Users\Meriem\Downloads\Universal-USB-Installer-1.9.5.2.exe
2014-05-25 02:34 - 2014-05-25 02:34 - 00036747 _____ () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso.torrent
2014-05-25 02:16 - 2014-05-25 02:15 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-05-25 02:15 - 2014-05-25 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2014-05-25 02:10 - 2014-04-20 11:36 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\vlc
2014-05-25 02:07 - 2014-05-25 02:03 - 445336096 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\avga141w7.exe
2014-05-25 02:06 - 2014-05-25 02:06 - 00000000 ____D () C:\Windows\SysWOW64\sda
2014-05-25 02:04 - 2014-04-20 00:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-25 02:04 - 2014-04-19 18:34 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-25 02:03 - 2014-05-25 02:03 - 06450792 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\cr159w7.exe
2014-05-25 01:59 - 2014-05-25 01:58 - 00000000 ____D () C:\Program Files (x86)\LinuxLive USB Creator
2014-05-25 01:58 - 2014-05-25 01:58 - 04999949 _____ (LinuxLive USB Creator) C:\Users\Meriem\Downloads\LinuxLive_USB_Creator_2.8.28.exe
2014-05-25 01:58 - 2014-05-25 01:58 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LinuxLive USB Creator
2014-05-25 01:33 - 2014-05-25 01:33 - 00000183 _____ () C:\Users\Meriem\Downloads\130827_rockenheim_tenaciousd_fes.mov
2014-05-25 00:49 - 2014-05-25 00:49 - 00000000 ____D () C:\Users\Meriem\Downloads\The Lego Movie (2014) BLU-RAY [Heartbleed]
2014-05-25 00:33 - 2014-05-25 00:17 - 1010827264 _____ () C:\Users\Meriem\Downloads\ubuntu-14.04-desktop-amd64.iso
2014-05-25 00:02 - 2010-11-21 05:24 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-05-25 00:02 - 2010-11-21 05:23 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-05-22 23:29 - 2014-05-22 13:48 - 00000000 ____D () C:\AdwCleaner
2014-05-22 13:48 - 2014-05-22 13:48 - 01326389 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.210.exe
2014-05-22 13:17 - 2014-05-22 13:16 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86.zip
2014-05-22 13:17 - 2014-05-22 13:16 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86 (1).zip
2014-05-22 12:57 - 2014-04-19 22:47 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-22 12:57 - 2014-04-19 22:47 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-22 02:43 - 2014-05-22 02:43 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-05-21 15:59 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-05-20 21:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-18 14:57 - 2014-05-18 14:52 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-18 14:56 - 2014-05-18 14:50 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Adobe
2014-05-18 14:56 - 2014-04-22 14:15 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Adobe
2014-05-18 14:54 - 2014-05-18 14:54 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 14:54 - 2014-05-18 14:54 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-18 14:53 - 2014-05-18 14:53 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-18 14:45 - 2014-05-18 14:45 - 00022792 _____ () C:\Users\Meriem\Desktop\Fragen + Antworten Skript.odt
2014-05-17 23:03 - 2014-05-17 23:03 - 05597688 _____ (Uniblue Systems Ltd ) C:\Users\Meriem\Downloads\driverscanner.exe
2014-05-17 22:42 - 2014-05-17 22:42 - 01325827 _____ () C:\Users\Meriem\Downloads\adwcleaner08 (2).exe
2014-05-16 20:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-16 17:05 - 2014-04-20 00:01 - 00000000 ___RD () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 16:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-16 01:17 - 2014-05-16 01:17 - 409233544 _____ () C:\Windows\MEMORY.DMP
2014-05-16 01:17 - 2014-05-16 01:17 - 00276480 _____ () C:\Windows\Minidump\051614-28267-01.dmp
2014-05-16 01:17 - 2014-05-16 01:17 - 00000000 ____D () C:\Windows\Minidump
2014-05-16 01:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SchCache

Files to move or delete:
====================
C:\ProgramData\dlprotect.exe


Some content of TEMP:
====================
C:\Users\Meriem\AppData\Local\Temp\2040-2082_re-markit.exe
C:\Users\Meriem\AppData\Local\Temp\amsetup_activeris_default_010414_installer.exe
C:\Users\Meriem\AppData\Local\Temp\AutoRun.exe
C:\Users\Meriem\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Meriem\AppData\Local\Temp\avgnt.exe
C:\Users\Meriem\AppData\Local\Temp\cloud_backup_setup.exe
C:\Users\Meriem\AppData\Local\Temp\eauninstall.exe
C:\Users\Meriem\AppData\Local\Temp\FIFA 07_uninst.exe
C:\Users\Meriem\AppData\Local\Temp\lly_webssearches.exe
C:\Users\Meriem\AppData\Local\Temp\media.exe
C:\Users\Meriem\AppData\Local\Temp\NewPlayerUpdater.exe
C:\Users\Meriem\AppData\Local\Temp\newvideoplayersetup.exe
C:\Users\Meriem\AppData\Local\Temp\nsg162A.exe
C:\Users\Meriem\AppData\Local\Temp\nsl55AD.exe
C:\Users\Meriem\AppData\Local\Temp\nsq1DB9.exe
C:\Users\Meriem\AppData\Local\Temp\nsw5DD9.exe
C:\Users\Meriem\AppData\Local\Temp\ose00000.exe
C:\Users\Meriem\AppData\Local\Temp\ProductKeyFinderSetup.exe
C:\Users\Meriem\AppData\Local\Temp\pyl385F.tmp.exe
C:\Users\Meriem\AppData\Local\Temp\pyl7A6C.tmp.exe
C:\Users\Meriem\AppData\Local\Temp\Quarantine.exe
C:\Users\Meriem\AppData\Local\Temp\SHSetup.exe
C:\Users\Meriem\AppData\Local\Temp\smtnew_qone8.exe
C:\Users\Meriem\AppData\Local\Temp\speedupmypc.exe
C:\Users\Meriem\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Meriem\AppData\Local\Temp\vopackage.exe
C:\Users\Meriem\AppData\Local\Temp\_is709E.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-11 18:13

==================== End Of Log ============================
         

--- --- ---
FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-06-2014
Ran by Meriem at 2014-06-15 22:23:51
Running from C:\Users\Meriem\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

µTorrent (HKCU\...\uTorrent) (Version: 3.4.1.30768 - BitTorrent Inc.)
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.10.100.30322 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{EB7F3D3C-1729-1743-FE07-6CA87F465500}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2013.0322.413.5642 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80322.0410 - Advanced Micro Devices, Inc.) Hidden
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.4.2.0 - AppEx Networks)
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0322.413.5642 - Ihr Firmenname) Hidden
Avira (HKLM-x32\...\{70a79d1f-686d-4d5c-962b-07aa1294eae0}) (Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Download Protect (HKCU\...\{132401a7-2006-4342-b43c-ccf5f02c2b01}) (Version:  - Download Protect)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.4 - Lenovo)
Energy Management (x32 Version: 7.0.3.4 - Lenovo) Hidden
EnergyCut (HKLM-x32\...\{6E127727-CE4B-40E4-9A7D-9D65CDE0A15C}) (Version: 1.00 - Lenovo)
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10206 - Realtek Semiconductor Corp.)
Lenovo_Wireless_Driver (HKLM-x32\...\{36CE10BD-A076-4DE3-A8A7-2F61E3FB2E6A}) (Version: 6.20.55.14 - Lenovo)
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.8 - Thibaut Lauziere)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
OEM Application Profile (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 6.2.9200.39041 - Realtek Semiconductor Corp.)
Shockwave (HKLM-x32\...\Shockwave) (Version:  - )
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.296 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.296 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.296 - TuneUp Software) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2881065) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B7EF38F7-1D58-4085-A9A4-0F6C69A5AA1E}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
WinRAR 5.10 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.2 - win.rar GmbH)

==================== Restore Points  =========================

25-05-2014 00:04:59 Installiert Realtek USB Card Reader
25-05-2014 20:46:14 Windows-Sicherung
28-05-2014 21:34:22 Uniblue SpeedUpMyPC installation
02-06-2014 22:26:31 Windows-Sicherung
09-06-2014 14:58:56 Windows-Sicherung
11-06-2014 01:00:21 Windows Update
13-06-2014 17:41:42 TuneUp Utilities 2014 wird installiert
15-06-2014 17:04:52 Windows-Sicherung
15-06-2014 17:14:51 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {32A368A6-44B3-4A2E-9466-EE7F342E072C} - \SomotoUpdateCheckerAutoStart No Task File <==== ATTENTION
Task: {3A7D86A2-2ECC-4BD0-82F2-7256B8383DED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13] (Google Inc.)
Task: {84E252D5-1B05-4A99-ABA5-611C867C51FA} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {8A876ABD-566D-4E33-9726-213253CA4633} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {8DFAA3AC-EC7E-498C-9C17-E0FCFF667C6F} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {9243095E-05F9-4A6D-B970-C7A737FC3735} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2847094928-2611277413-3262722226-1000
Task: {9F10D918-6EAC-4135-9CC4-BBEA8D83DD07} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {A512DD33-7FBB-46AE-AD56-3474A0AF52D3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {C178AFD6-56F8-4FE9-9D72-FC93189A981B} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-05-08] (Adobe Systems Incorporated)
Task: {FC0E6EA0-3FCC-4E72-A8B1-EC0CC4C09004} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2008-12-20 03:20 - 2014-04-19 18:41 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-10 16:30 - 2014-04-19 18:41 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2014-04-19 18:41 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2014-04-19 18:40 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2013-03-22 04:24 - 2013-03-22 04:24 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-06-12 21:59 - 2014-06-12 21:59 - 00123392 _____ () C:\Windows\System32\DlProtectSvc.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2013-03-22 04:24 - 2013-03-22 04:24 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-04-15 15:59 - 2014-04-15 15:59 - 00675640 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2014-06-13 01:28 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-13 01:28 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-13 01:28 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-13 01:28 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-13 01:28 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-04-19 22:48 - 2014-05-05 10:37 - 00049744 _____ () C:\Users\Meriem\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-04-21 12:36 - 2005-06-24 19:05 - 00045056 _____ () C:\Program Files (x86)\Lenovo\EnergyCut\HookLib.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00138320 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 14612296 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMPCHelper => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver => ""=""

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: BCM43142A0
Description: BCM43142A0
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/13/2014 07:01:44 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm hijackthis_5833.exe, Version 2.0.0.4 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 4fc

Startzeit: 01cf872918cd6595

Endzeit: 13

Anwendungspfad: C:\Users\Meriem\Downloads\hijackthis_5833.exe

Berichts-ID: 62938f2a-f31c-11e3-9600-ebe68af209c1

Error: (06/13/2014 06:20:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/13/2014 06:20:20 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/13/2014 05:30:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm HiJackThis204.exe, Version 2.0.0.4 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 13c4

Startzeit: 01cf871bea2d43e5

Endzeit: 121

Anwendungspfad: C:\Users\Meriem\Downloads\HiJackThis204.exe

Berichts-ID: 90223085-f30f-11e3-9ac4-f7397ef29ace

Error: (06/13/2014 04:57:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17126, Zeitstempel: 0x53882e30
Name des fehlerhaften Moduls: jscript9.dll, Version: 11.0.9600.17126, Zeitstempel: 0x53883991
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00011d06
ID des fehlerhaften Prozesses: 0x8d8
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (06/13/2014 11:51:50 AM) (Source: Google Update) (EventID: 20) (User: Meriem-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http s

Error: (06/13/2014 02:41:00 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 90080108

Error: (06/13/2014 00:26:20 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/13/2014 00:25:43 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/12/2014 11:17:14 PM) (Source: Software Protection Platform Service) (EventID: 8193) (User: )
Description: Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:
0x80070005


System errors:
=============
Error: (06/13/2014 06:07:30 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Update raving reyven" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/13/2014 06:07:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Util raving reyven" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/12/2014 03:08:29 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (06/12/2014 05:00:21 AM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\System32\slui.exe -Embedding5{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

Error: (06/11/2014 06:42:05 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JAN-SAMSUNG",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{849EE174-C504-43D0-8A37-FDC36C3A1817}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (06/11/2014 05:21:38 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (06/11/2014 04:14:15 AM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\System32\slui.exe -Embedding5{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

Error: (06/10/2014 11:39:27 PM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\System32\slui.exe -Embedding5{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

Error: (06/09/2014 04:55:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/06/2014 00:09:23 AM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\System32\slui.exe -Embedding5{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 3529.27 MB
Available physical RAM: 1980.63 MB
Total Pagefile: 7056.72 MB
Available Pagefile: 4805.06 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:244.83 GB) (Free:176.58 GB) NTFS
Drive e: (Ubuntu 14.04 LTS) (CDROM) (Total:0.94 GB) (Free:0 GB) CDFS
Drive g: (Daten) (Fixed) (Total:220.7 GB) (Free:219.6 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: D9FA2484)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

--- --- ---

Alle Tools auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.





Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

es kam die ganze zeit die fehlermeldung:
pve.exe u pve.3xe funktioniert nicht mehr, ich habe es dann immer geschlossen, hier das logfile:

ComboFix 14-06-16.01 - Meriem 16.06.2014  14:10:11.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3529.2268 [GMT 2:00]
ausgeführt von:: c:\users\Meriem\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\dlprotect.exe
c:\users\Meriem\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_IePluginServices
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-16 bis 2014-06-16  ))))))))))))))))))))))))))))))
.
.
2014-06-15 20:19 . 2014-06-15 20:30	--------	d-----w-	C:\FRST
2014-06-13 17:43 . 2014-04-15 13:59	40760	----a-w-	c:\windows\system32\TURegOpt.exe
2014-06-13 17:43 . 2014-04-15 13:59	29496	----a-w-	c:\windows\system32\authuitu.dll
2014-06-13 17:43 . 2014-04-15 13:59	25400	----a-w-	c:\windows\SysWow64\authuitu.dll
2014-06-13 17:42 . 2014-06-13 17:42	--------	d-----w-	c:\users\Meriem\AppData\Roaming\TuneUp Software
2014-06-13 17:42 . 2014-06-13 17:42	--------	d-----w-	c:\users\Meriem\AppData\Local\TuneUp Software
2014-06-13 17:42 . 2014-06-13 17:43	--------	d-----w-	c:\program files (x86)\TuneUp Utilities 2014
2014-06-13 17:41 . 2014-06-13 17:48	--------	d-----w-	c:\programdata\TuneUp Software
2014-06-13 17:41 . 2014-06-16 12:49	--------	d-sh--w-	c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-06-13 17:41 . 2014-06-13 17:41	--------	d--h--w-	c:\programdata\Common Files
2014-06-12 23:28 . 2013-09-20 08:49	21040	----a-w-	c:\windows\system32\sdnclean64.exe
2014-06-12 23:28 . 2014-06-13 10:01	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2014-06-12 23:28 . 2014-06-12 23:30	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy 2
2014-06-12 22:51 . 2014-06-12 22:51	--------	d-----w-	c:\users\Meriem\AppData\Roaming\SupTab
2014-06-12 22:51 . 2014-06-13 16:12	--------	d-----w-	c:\programdata\WindowsProtectManger
2014-06-12 22:51 . 2014-06-12 22:51	--------	d-----w-	c:\programdata\IePluginServices
2014-06-12 22:51 . 2014-06-12 22:51	--------	d-----w-	c:\program files (x86)\SupTab
2014-06-12 22:50 . 2014-06-12 22:50	--------	d-----w-	c:\program files\003
2014-06-12 21:03 . 2014-06-09 10:10	61120	----a-w-	c:\windows\system32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-06-12 20:02 . 2014-06-12 20:02	--------	d-----w-	c:\users\Meriem\AppData\Local\Skype
2014-06-12 20:01 . 2014-06-12 22:04	--------	d-----w-	c:\users\Meriem\AppData\Roaming\Skype
2014-06-12 20:01 . 2014-06-12 20:01	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-06-12 20:01 . 2014-06-12 20:01	--------	d-----r-	c:\program files (x86)\Skype
2014-06-12 20:00 . 2014-06-12 20:01	--------	d-----w-	c:\programdata\Skype
2014-06-12 19:59 . 2014-06-12 19:59	119296	----a-w-	c:\windows\system32\PerfCfnterCPL.exe
2014-06-12 19:59 . 2014-06-12 19:59	123392	----a-w-	c:\windows\system32\DlProtectSvc.exe
2014-06-12 19:57 . 2014-06-13 16:56	--------	d-----w-	c:\program files (x86)\globalUpdate
2014-06-12 19:57 . 2014-06-12 19:57	--------	d-----w-	c:\users\Meriem\AppData\Local\globalUpdate
2014-06-11 00:03 . 2014-06-08 09:13	506368	----a-w-	c:\windows\system32\aepdu.dll
2014-06-11 00:03 . 2014-06-08 09:08	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-06-09 23:29 . 2014-06-09 23:29	163504	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2014-06-05 12:39 . 2014-06-05 12:39	--------	d-----w-	c:\users\Meriem\AppData\Roaming\Mnemosyne
2014-06-05 12:39 . 2014-06-05 12:39	--------	d-----w-	c:\users\Meriem\.matplotlib
2014-05-28 21:38 . 2014-05-28 21:38	--------	d-----w-	c:\users\Meriem\AppData\Local\com
2014-05-28 21:36 . 2014-06-02 22:25	--------	d-----w-	c:\users\Meriem\AppData\Roaming\Activeris
2014-05-28 21:34 . 2014-06-11 09:02	--------	d-----w-	c:\program files (x86)\Re-markit-soft
2014-05-27 22:11 . 2014-06-02 22:16	--------	d-----w-	c:\users\Meriem\AppData\Local\Spotify
2014-05-27 22:09 . 2014-06-03 19:07	--------	d-----w-	c:\users\Meriem\AppData\Roaming\Spotify
2014-05-25 11:13 . 2014-05-25 11:13	--------	d-----w-	c:\program files (x86)\ShowMyPCService
2014-05-25 00:15 . 2014-05-25 00:16	--------	d-----w-	c:\program files\AMD Quick Stream
2014-05-25 00:15 . 2013-03-21 10:21	217824	----a-w-	c:\windows\system32\drivers\appexDrv.sys
2014-05-25 00:15 . 2012-08-28 18:27	58536	----a-w-	c:\windows\system32\drivers\usbfilter.sys
2014-05-25 00:06 . 2014-05-25 00:06	--------	d-----w-	c:\windows\SysWow64\sda
2014-05-25 00:04 . 2013-01-15 15:37	327240	----a-w-	c:\windows\system32\drivers\RtsUVStor.sys
2014-05-25 00:04 . 2013-01-15 15:37	9889352	----a-w-	c:\windows\SysWow64\RtsUVStoricon.dll
2014-05-24 23:58 . 2014-05-24 23:59	--------	d-----w-	c:\program files (x86)\LinuxLive USB Creator
2014-05-24 22:02 . 2014-05-24 22:02	--------	d-----w-	c:\windows\SysWow64\Wat
2014-05-24 22:02 . 2014-05-24 22:02	--------	d-----w-	c:\windows\system32\Wat
2014-05-22 11:48 . 2014-05-22 21:29	--------	d-----w-	C:\AdwCleaner
2014-05-18 12:53 . 2014-05-18 12:53	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2014-05-18 12:50 . 2014-05-18 12:56	--------	d-----w-	c:\users\Meriem\AppData\Local\Adobe
2014-05-17 20:45 . 2010-08-30 06:34	536576	----a-w-	c:\windows\SysWow64\sqlite3.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-16 02:41 . 2014-04-19 16:53	65536	----a-w-	c:\windows\system32\spu_storage.bin
2014-06-11 01:09 . 2014-05-15 23:12	95414520	----a-w-	c:\windows\system32\MRT.exe
2014-06-02 22:20 . 2014-05-15 18:45	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-24 22:02 . 2010-11-21 03:24	14848	----a-w-	c:\windows\system32\slwga.dll
2014-05-24 22:02 . 2010-11-21 03:24	419840	----a-w-	c:\windows\system32\systemcpl.dll
2014-05-24 22:02 . 2010-11-21 03:23	13824	----a-w-	c:\windows\SysWow64\slwga.dll
2014-05-24 22:02 . 2010-11-21 03:24	1008640	----a-w-	c:\windows\system32\user32.dll
2014-05-24 22:02 . 2010-11-21 03:24	833024	----a-w-	c:\windows\SysWow64\user32.dll
2014-05-22 10:57 . 2014-04-19 20:47	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-05-22 10:57 . 2014-04-19 20:47	112080	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-04-22 22:38 . 2014-04-22 22:38	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2014-04-22 22:38 . 2014-04-22 22:38	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2014-04-22 22:38 . 2014-04-22 22:38	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2014-04-22 22:38 . 2014-04-22 22:38	235008	----a-w-	c:\windows\system32\elshyph.dll
2014-04-22 22:38 . 2014-04-22 22:38	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2014-04-22 22:38 . 2014-04-22 22:38	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2014-04-22 22:38 . 2014-04-22 22:38	337408	----a-w-	c:\windows\SysWow64\html.iec
2014-04-22 22:37 . 2014-04-22 22:37	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2014-04-22 22:37 . 2014-04-22 22:37	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2014-04-22 22:37 . 2014-04-22 22:37	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2014-04-22 22:37 . 2014-04-22 22:37	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2014-04-22 22:37 . 2014-04-22 22:37	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2014-04-22 22:37 . 2014-04-22 22:37	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2014-04-22 22:37 . 2014-04-22 22:37	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2014-04-22 22:37 . 2014-04-22 22:37	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2014-04-22 22:37 . 2014-04-22 22:37	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2014-04-22 22:37 . 2014-04-22 22:37	942592	----a-w-	c:\windows\system32\jsIntl.dll
2014-04-22 22:37 . 2014-04-22 22:37	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2014-04-22 22:37 . 2014-04-22 22:37	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2014-04-22 22:37 . 2014-04-22 22:37	247808	----a-w-	c:\windows\system32\msls31.dll
2014-04-22 22:37 . 2014-04-22 22:37	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2014-04-22 22:37 . 2014-04-22 22:37	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2014-04-22 22:37 . 2014-04-22 22:37	48640	----a-w-	c:\windows\system32\mshtmler.dll
2014-04-22 22:37 . 2014-04-22 22:37	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2014-04-22 22:37 . 2014-04-22 22:37	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2014-04-22 22:37 . 2014-04-22 22:37	105984	----a-w-	c:\windows\system32\iesysprep.dll
2014-04-22 22:37 . 2014-04-22 22:37	81408	----a-w-	c:\windows\system32\icardie.dll
2014-04-22 22:37 . 2014-04-22 22:37	77312	----a-w-	c:\windows\system32\tdc.ocx
2014-04-22 22:37 . 2014-04-22 22:37	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2014-04-22 22:37 . 2014-04-22 22:37	413696	----a-w-	c:\windows\system32\html.iec
2014-04-22 22:37 . 2014-04-22 22:37	30208	----a-w-	c:\windows\system32\licmgr10.dll
2014-04-22 22:37 . 2014-04-22 22:37	263376	----a-w-	c:\windows\system32\iedkcs32.dll
2014-04-22 22:37 . 2014-04-22 22:37	243200	----a-w-	c:\windows\system32\webcheck.dll
2014-04-22 22:37 . 2014-04-22 22:37	235520	----a-w-	c:\windows\system32\url.dll
2014-04-22 22:37 . 2014-04-22 22:37	167424	----a-w-	c:\windows\system32\iexpress.exe
2014-04-22 22:37 . 2014-04-22 22:37	143872	----a-w-	c:\windows\system32\wextract.exe
2014-04-22 22:37 . 2014-04-22 22:37	101376	----a-w-	c:\windows\system32\inseng.dll
2014-04-22 22:37 . 2014-04-22 22:37	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-04-22 22:37 . 2014-04-22 22:37	774144	----a-w-	c:\windows\system32\jscript.dll
2014-04-22 22:37 . 2014-04-22 22:37	62464	----a-w-	c:\windows\system32\pngfilt.dll
2014-04-22 22:37 . 2014-04-22 22:37	48128	----a-w-	c:\windows\system32\imgutil.dll
2014-04-22 22:37 . 2014-04-22 22:37	147968	----a-w-	c:\windows\system32\occache.dll
2014-04-22 22:37 . 2014-04-22 22:37	13824	----a-w-	c:\windows\system32\mshta.exe
2014-04-22 22:37 . 2014-04-22 22:37	135680	----a-w-	c:\windows\system32\iepeers.dll
2014-04-21 21:50 . 2014-04-21 21:50	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	522752	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2014-04-21 21:50 . 2014-04-21 21:50	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2014-04-21 21:50 . 2014-04-21 21:50	363008	----a-w-	c:\windows\system32\dxgi.dll
2014-04-21 21:50 . 2014-04-21 21:50	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	2776576	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2014-04-21 21:50 . 2014-04-21 21:50	2560	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	2560	---ha-w-	c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	2284544	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2014-04-21 21:50 . 2014-04-21 21:50	220160	----a-w-	c:\windows\SysWow64\d3d10core.dll
2014-04-21 21:50 . 2014-04-21 21:50	207872	----a-w-	c:\windows\SysWow64\WindowsCodecsExt.dll
2014-04-21 21:50 . 2014-04-21 21:50	1682432	----a-w-	c:\windows\system32\XpsPrint.dll
2014-04-21 21:50 . 2014-04-21 21:50	1643520	----a-w-	c:\windows\system32\DWrite.dll
2014-04-21 21:50 . 2014-04-21 21:50	1247744	----a-w-	c:\windows\SysWow64\DWrite.dll
2014-04-21 21:50 . 2014-04-21 21:50	1175552	----a-w-	c:\windows\system32\FntCache.dll
2014-04-21 21:50 . 2014-04-21 21:50	1158144	----a-w-	c:\windows\SysWow64\XpsPrint.dll
2014-04-21 21:50 . 2014-04-21 21:50	1080832	----a-w-	c:\windows\SysWow64\d3d10.dll
2014-04-21 21:50 . 2014-04-21 21:50	10752	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	10752	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-04-21 21:50 . 2014-04-21 21:50	648192	----a-w-	c:\windows\system32\d3d10level9.dll
2014-04-21 21:50 . 2014-04-21 21:50	604160	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2014-04-21 21:50 . 2014-04-21 21:50	333312	----a-w-	c:\windows\system32\d3d10_1core.dll
2014-04-21 21:50 . 2014-04-21 21:50	296960	----a-w-	c:\windows\system32\d3d10core.dll
2014-04-21 21:50 . 2014-04-21 21:50	293376	----a-w-	c:\windows\SysWow64\dxgi.dll
2014-04-21 21:50 . 2014-04-21 21:50	249856	----a-w-	c:\windows\SysWow64\d3d10_1core.dll
2014-04-21 21:50 . 2014-04-21 21:50	245248	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2014-04-21 21:50 . 2014-04-21 21:50	221184	----a-w-	c:\windows\system32\UIAnimation.dll
2014-04-21 21:50 . 2014-04-21 21:50	194560	----a-w-	c:\windows\system32\d3d10_1.dll
2014-04-21 21:50 . 2014-04-21 21:50	187392	----a-w-	c:\windows\SysWow64\UIAnimation.dll
2014-04-21 21:50 . 2014-04-21 21:50	161792	----a-w-	c:\windows\SysWow64\d3d10_1.dll
2014-04-21 21:50 . 2014-04-21 21:50	1238528	----a-w-	c:\windows\system32\d3d10.dll
2014-04-20 08:03 . 2014-04-20 08:03	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-04-19 17:57 . 2014-04-19 17:57	283064	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2014-04-19 16:41 . 2014-04-19 16:41	19872	----a-w-	c:\windows\system32\LenovoSDKEmSubSystem.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
2014-05-08 10:52	513648	----a-w-	c:\program files (x86)\SupTab\SupTab.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AppEx Accelerator UI"="c:\program files\AMD Quick Stream\AMDQuickStream.exe" [2013-02-08 429792]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]
"Spotify Web Helper"="c:\users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-05-27 1176632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-22 642656]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-05-22 737872]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"EnergyUtility"="c:\program files (x86)\Lenovo\EnergyCut\utilty.exe" [2007-04-27 1581056]
"EnergyCut"="c:\program files (x86)\Lenovo\EnergyCut\EnergyCut.exe" [2007-03-09 1167360]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-05-05 182352]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-04-25 4101584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\SupTab\SearchProtect32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x]
S1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64;{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64;c:\windows\system32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys;c:\windows\SYSNATIVE\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 APXACC;AppEx Networks Accelerator LWF;c:\windows\system32\DRIVERS\appexDrv.sys;c:\windows\SYSNATIVE\DRIVERS\appexDrv.sys [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 DlProtectSvc;Download Protect Service;c:\windows\System32\DlProtectSvc.exe;c:\windows\SYSNATIVE\DlProtectSvc.exe [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [x]
S2 xcopy64;exFAT avgntflt UMBusenumerator-Treiber;c:\windows\system32\PerfCfnterCPL.exe;c:\windows\SYSNATIVE\PerfCfnterCPL.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys;c:\windows\SYSNATIVE\DRIVERS\amdhub30.sys [x]
S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys;c:\windows\SYSNATIVE\DRIVERS\amdxhc.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 rtsuvc;Lenovo EasyCamera;c:\windows\system32\DRIVERS\rtsuvc.sys;c:\windows\SYSNATIVE\DRIVERS\rtsuvc.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-06-13 16:23	1091912	----a-w-	c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13 16:21]
.
2014-06-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13 16:21]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtsFT"="RTFTrack.exe" [2013-01-04 6346464]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2014-04-19 8079408]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2014-04-19 6199128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\SupTab\SearchProtect64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
mDefault_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
mDefault_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
mStart Page = hxxp://istart.webssearches.com/?type=hp&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1402613434&from=tugs&uid=ST500LM000-SSHD-8GB_W372PYKQXXXXW372PYKQ&q={searchTerms}
TCP: DhcpNameServer = 192.168.2.1 192.168.1.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{11111111-1111-1111-1111-110511831160} - (no file)
Wow6432Node-HKLM-Run-Download Protect - c:\programdata\dlprotect.exe
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Shockwave - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-06-16  15:01:37 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-06-16 13:01
.
Vor Suchlauf: 10 Verzeichnis(se), 189.055.111.168 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 188.865.327.104 Bytes frei
.
- - End Of File - - 2CA412690415E29377823A18C2DB8EAD
5FB38429D5D77768867C76DCBDB35194
         

Schritt 1
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3
Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann.
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.

• Starte Zoek.exe mit einem Doppelklick.
• Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und könnte andere Computer beschädigen.
• Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
  

  iedefaults;
  resetIEproxy;
  FFdefaults;
  CHRdefaults;
  emptyclsid;
  autoclean;
           

• Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
• Wenn das Tool fertig ist, wird sich Notepad mit der Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:\ .
• Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken).

Schritt 4

• Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

• die Logdatei von AdwCleaner,
• die Logdatei von MBAM,
• die Logdatei von Zoek,
• die beiden neuen Logdateien von FRST.

# AdwCleaner v3.212 - Bericht erstellt am 16/06/2014 um 23:40:25
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Meriem - MERIEM-PC
# Gestartet von : C:\Users\Meriem\Downloads\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\WindowsProtectManger
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Program Files (x86)\Re-markit-soft
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Program Files\003
Ordner Gelöscht : C:\Users\Meriem\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Meriem\AppData\Roaming\Activeris
Ordner Gelöscht : C:\Users\Meriem\AppData\Roaming\SupTab

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ActiverisAntiMalware_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ActiverisAntiMalware_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110511831160}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522832260}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522842288}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555835560}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555845588}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566836660}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566846688}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511831160}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555835560}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550555845588}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566836660}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566846688}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\suprasavings
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\webssearchesSoftware
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\suprasavings
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SearchProtect32.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SearchProtect64.dll

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Google Chrome v35.0.1916.153

[ Datei : C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1725 octets] - [22/05/2014 13:48:49]
AdwCleaner[R1].txt - [6246 octets] - [16/06/2014 23:38:20]
AdwCleaner[S0].txt - [1730 octets] - [22/05/2014 23:26:53]
AdwCleaner[S1].txt - [5246 octets] - [16/06/2014 23:40:25]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5306 octets] ##########
         

<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>


-<header>

<date>2014/06/16 23:51:44 +0200</date>

<logfile>mbam-log-2014-06-16 (23-51-42).xml</logfile>

<isadmin>yes</isadmin>

</header>


-<engine>

<version>2.00.2.1012</version>

<malware-database>v2014.06.16.07</malware-database>

<rootkit-database>v2014.06.02.01</rootkit-database>

<license>free</license>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


-<system>

<osversion>Windows 7 Service Pack 1</osversion>

<arch>x64</arch>

<username>Meriem</username>

<filesys>NTFS</filesys>

</system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>271590</objects>

<time>1114</time>

<processes>0</processes>

<modules>0</modules>

<keys>1</keys>

<values>0</values>

<datas>0</datas>

<folders>0</folders>

<files>0</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>


-<items>


-<key>

<path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HD-V1.3</path>

<vendor>PUP.Optional.PlusHD.A</vendor>

<action>delete-on-reboot</action>

<hash>e14658219dde66d0270ad0d29270f10f</hash>

</key>

</items>

</mbam-log>
         

Zoek.exe v5.0.0.0 Updated 16-June-2014
Tool run by Meriem on 17.06.2014 at  0:23:05,53.
Microsoft Windows 7 Professional  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Meriem\Downloads\zoek.exe    [Scan all users] [Script inserted] 

==== System Restore Info ======================

17.06.2014 00:25:16 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wpm deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Wpm deleted successfully

==== Deleting Files \ Folders ======================

C:\PROGRA~3\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} deleted
C:\PROGRA~3\Package Cache deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{6D752195-EBEB-4A41-9BBF-C28460214255}"="C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi" [16.06.2014 14:51]

==== Chrome Look ======================

Download Protect - Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\loamfbljbnlmjhegngflknebcagnbohg

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Default_Page_URL"="hxxp://www.google.com"
"Start Page"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google\Chrome\ExtensionInstallForcelist deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Meriem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Meriem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=13 folders=5 5018425 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Meriem\AppData\Local\Temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Meriem\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 17.06.2014 at  0:57:11,31 ======================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-06-2014
Ran by Meriem at 2014-06-17 01:06:07
Running from C:\Users\Meriem\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

µTorrent (HKCU\...\uTorrent) (Version: 3.4.1.30768 - BitTorrent Inc.)
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.10.100.30322 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{EB7F3D3C-1729-1743-FE07-6CA87F465500}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2013.0322.413.5642 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80322.0410 - Advanced Micro Devices, Inc.) Hidden
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.4.2.0 - AppEx Networks)
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0322.413.5642 - Ihr Firmenname) Hidden
Avira (HKLM-x32\...\{70a79d1f-686d-4d5c-962b-07aa1294eae0}) (Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Download Protect (HKCU\...\{132401a7-2006-4342-b43c-ccf5f02c2b01}) (Version:  - Download Protect)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.4 - Lenovo)
Energy Management (x32 Version: 7.0.3.4 - Lenovo) Hidden
EnergyCut (HKLM-x32\...\{6E127727-CE4B-40E4-9A7D-9D65CDE0A15C}) (Version: 1.00 - Lenovo)
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10206 - Realtek Semiconductor Corp.)
Lenovo_Wireless_Driver (HKLM-x32\...\{36CE10BD-A076-4DE3-A8A7-2F61E3FB2E6A}) (Version: 6.20.55.14 - Lenovo)
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.8 - Thibaut Lauziere)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
OEM Application Profile (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 6.2.9200.39041 - Realtek Semiconductor Corp.)
Shockwave (HKLM-x32\...\Shockwave) (Version:  - )
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.296 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.296 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.296 - TuneUp Software) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2881065) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B7EF38F7-1D58-4085-A9A4-0F6C69A5AA1E}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
WinRAR 5.10 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.2 - win.rar GmbH)

==================== Restore Points  =========================

25-05-2014 20:46:14 Windows-Sicherung
28-05-2014 21:34:22 Uniblue SpeedUpMyPC installation
02-06-2014 22:26:31 Windows-Sicherung
09-06-2014 14:58:56 Windows-Sicherung
11-06-2014 01:00:21 Windows Update
13-06-2014 17:41:42 TuneUp Utilities 2014 wird installiert
15-06-2014 17:04:52 Windows-Sicherung
15-06-2014 17:14:51 Windows-Sicherung
16-06-2014 22:24:48 zoek.exe restore point

==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-06-16 14:48 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {32A368A6-44B3-4A2E-9466-EE7F342E072C} - \SomotoUpdateCheckerAutoStart No Task File <==== ATTENTION
Task: {3A7D86A2-2ECC-4BD0-82F2-7256B8383DED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13] (Google Inc.)
Task: {84E252D5-1B05-4A99-ABA5-611C867C51FA} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {8A876ABD-566D-4E33-9726-213253CA4633} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {8DFAA3AC-EC7E-498C-9C17-E0FCFF667C6F} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {9243095E-05F9-4A6D-B970-C7A737FC3735} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2847094928-2611277413-3262722226-1000
Task: {9F10D918-6EAC-4135-9CC4-BBEA8D83DD07} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {A512DD33-7FBB-46AE-AD56-3474A0AF52D3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {C178AFD6-56F8-4FE9-9D72-FC93189A981B} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-05-08] (Adobe Systems Incorporated)
Task: {FC0E6EA0-3FCC-4E72-A8B1-EC0CC4C09004} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-03-22 04:24 - 2013-03-22 04:24 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-06-12 21:59 - 2014-06-12 21:59 - 00123392 _____ () C:\Windows\System32\DlProtectSvc.exe
2014-04-15 15:59 - 2014-04-15 15:59 - 00675640 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2008-12-20 03:20 - 2014-04-19 18:41 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-10 16:30 - 2014-04-19 18:41 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2014-04-19 18:41 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2014-04-19 18:40 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2013-03-22 04:24 - 2013-03-22 04:24 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-06-13 01:28 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-13 01:28 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-13 01:28 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-13 01:28 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-13 01:28 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00138320 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-06-17 00:57 - 2014-05-05 10:37 - 00049744 _____ () C:\Users\Meriem\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-04-21 12:36 - 2005-06-24 19:05 - 00045056 _____ () C:\Program Files (x86)\Lenovo\EnergyCut\HookLib.dll
2014-06-16 14:51 - 2014-06-16 14:51 - 00012288 _____ () C:\Program Files (x86)\Google\Chrome\Application\WTSAPI32.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 14612296 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMPCHelper => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver => ""=""

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: BCM43142A0
Description: BCM43142A0
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/17/2014 00:56:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2014 00:56:28 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/17/2014 00:15:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2014 00:15:13 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/16/2014 11:42:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/16/2014 11:42:00 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/16/2014 03:31:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/16/2014 03:30:16 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/16/2014 02:56:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x75a0ca35
ID des fehlerhaften Prozesses: 0xeac
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3

Error: (06/16/2014 02:56:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: pev.3XE, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: SHLWAPI.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4ce7b9e2
Ausnahmecode: 0xc0000005
Fehleroffset: 0x75a2f69b
ID des fehlerhaften Prozesses: 0x4c8
Startzeit der fehlerhaften Anwendung: 0xpev.3XE0
Pfad der fehlerhaften Anwendung: pev.3XE1
Pfad des fehlerhaften Moduls: pev.3XE2
Berichtskennung: pev.3XE3


System errors:
=============
Error: (06/17/2014 00:44:27 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:26 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:25 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:25 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:24 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:24 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:23 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:22 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:22 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:21 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-06-16 14:47:36.067
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-06-16 14:47:35.772
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 42%
Total physical RAM: 3529.27 MB
Available physical RAM: 2017.78 MB
Total Pagefile: 7056.72 MB
Available Pagefile: 4798.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:244.83 GB) (Free:176.7 GB) NTFS
Drive e: (Ubuntu 14.04 LTS) (CDROM) (Total:0.94 GB) (Free:0 GB) CDFS
Drive g: (Daten) (Fixed) (Total:220.7 GB) (Free:219.6 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: D9FA2484)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-06-2014
Ran by Meriem (administrator) on MERIEM-PC on 17-06-2014 01:04:56
Running from C:\Users\Meriem\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Windows\System32\DlProtectSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
() C:\Windows\System32\PerfCfnterCPL.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AMDQuickStream.exe
(Spotify Ltd) C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6346464 2013-01-04] (Realtek semiconductor)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2014-04-19] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2014-04-19] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe [1581056 2007-04-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [EnergyCut] => C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe [1167360 2007-03-09] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [182352 2014-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [429792 2013-02-08] (AppEx Networks Corporation)
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [Spotify Web Helper] => C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-28] (Spotify Ltd)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.1.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Meriem\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File
FF HKLM-x32\...\Firefox\Extensions: [{6D752195-EBEB-4A41-9BBF-C28460214255}] - C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi [2014-06-16]

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-13]
CHR Extension: (Google Drive) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-13]
CHR Extension: (YouTube) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-13]
CHR Extension: (Google-Suche) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-13]
CHR Extension: (Google Wallet) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-13]
CHR Extension: (Google Mail) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-13]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-22] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [124496 2014-05-05] (Avira Operations GmbH & Co. KG)
R2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [123392 2014-06-12] () [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2140984 2014-04-15] (TuneUp Software)
R2 xcopy64; C:\Windows\system32\PerfCfnterCPL.exe [119296 2014-06-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [217824 2013-03-21] (AppEx Networks Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-19] (Disc Soft Ltd)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-04] (Realtek Semiconductor Corp.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-03-26] (TuneUp Software)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-06-09] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-17 00:55 - 2014-06-17 01:05 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:22 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-06-17 00:24 - 2014-06-17 00:57 - 00006411 _____ () C:\zoek-results.log
2014-06-17 00:22 - 2014-06-17 00:44 - 00000000 ____D () C:\zoek_backup
2014-06-17 00:22 - 2014-06-17 00:22 - 01285120 _____ () C:\Users\Meriem\Downloads\zoek.exe
2014-06-16 23:50 - 2014-06-16 23:50 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-16 23:50 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-16 23:50 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-16 23:50 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-16 23:48 - 2014-06-16 23:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Meriem\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-16 23:37 - 2014-06-16 23:38 - 01333465 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.212.exe
2014-06-16 15:01 - 2014-06-16 15:01 - 00025408 _____ () C:\ComboFix.txt
2014-06-16 14:52 - 2014-06-16 14:52 - 00000728 __RSH () C:\ProgramData\ntuser.pol
2014-06-16 14:02 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-16 14:02 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-16 14:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-16 13:52 - 2014-06-16 15:01 - 00000000 ____D () C:\Qoobox
2014-06-16 13:52 - 2014-06-16 14:54 - 00000000 ____D () C:\Windows\erdnt
2014-06-16 13:50 - 2014-06-16 13:50 - 05206841 ____R (Swearware) C:\Users\Meriem\Desktop\ComboFix.exe
2014-06-15 22:23 - 2014-06-15 22:30 - 00027769 _____ () C:\Users\Meriem\Downloads\Addition.txt
2014-06-15 22:20 - 2014-06-17 01:05 - 00012723 _____ () C:\Users\Meriem\Downloads\FRST.txt
2014-06-15 22:19 - 2014-06-17 01:04 - 00000000 ____D () C:\FRST
2014-06-15 22:19 - 2014-06-15 22:19 - 02081280 _____ (Farbar) C:\Users\Meriem\Downloads\FRST64.exe
2014-06-13 19:56 - 2014-06-13 19:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-06-13 19:43 - 2014-06-13 19:43 - 00002213 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002205 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002193 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-06-13 19:43 - 2014-04-15 15:59 - 00040760 _____ (TuneUp Software) C:\Windows\system32\TURegOpt.exe
2014-06-13 19:43 - 2014-04-15 15:59 - 00029496 _____ (TuneUp Software) C:\Windows\system32\authuitu.dll
2014-06-13 19:43 - 2014-04-15 15:59 - 00025400 _____ (TuneUp Software) C:\Windows\SysWOW64\authuitu.dll
2014-06-13 19:42 - 2014-06-13 19:43 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\TuneUp Software
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Local\TuneUp Software
2014-06-13 19:41 - 2014-06-13 19:48 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-13 19:39 - 2014-06-13 19:40 - 27883432 _____ (TuneUp Software) C:\Users\Meriem\Downloads\TuneUpUtilities2014_de-DE.exe
2014-06-13 19:01 - 2014-06-13 19:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Meriem\Downloads\hijackthis_5833.exe
2014-06-13 18:23 - 2014-06-13 18:23 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-13 18:23 - 2014-06-13 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-13 18:21 - 2014-06-17 00:56 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 18:21 - 2014-06-17 00:26 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 18:21 - 2014-06-13 18:21 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-13 18:21 - 2014-06-13 18:21 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-13 18:17 - 2014-06-13 18:17 - 00918672 _____ (Google Inc.) C:\Users\Meriem\Downloads\ChromeSetup.exe
2014-06-13 17:34 - 2014-06-13 19:02 - 00010925 _____ () C:\Users\Meriem\Downloads\hijackthis.log
2014-06-13 12:04 - 2009-06-10 23:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20140613-120430.backup
2014-06-13 01:29 - 2014-06-13 01:29 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-13 01:28 - 2014-06-13 12:01 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-13 01:28 - 2014-06-13 01:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-13 01:28 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-06-13 01:23 - 2014-06-13 01:25 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Meriem\Downloads\spybot-2.3.exe
2014-06-13 01:20 - 2014-06-13 01:20 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Meriem\Downloads\SpyHunter-Installer (2).exe
2014-06-12 23:03 - 2014-06-09 12:10 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-06-12 22:02 - 2014-06-12 22:02 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Skype
2014-06-12 22:01 - 2014-06-13 00:04 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-06-12 22:00 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Skype
2014-06-12 21:59 - 2014-06-12 21:59 - 00123392 _____ () C:\Windows\system32\DlProtectSvc.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2014-06-12 21:56 - 2014-06-12 21:56 - 00469376 _____ () C:\Users\Meriem\Downloads\skype.exe
2014-06-11 02:05 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 02:05 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 02:05 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 02:05 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 02:05 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 02:05 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 02:05 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 02:05 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 02:05 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 02:05 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 02:05 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 02:05 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 02:05 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 02:05 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 02:05 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 02:05 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 02:05 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 02:05 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 02:05 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 02:05 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 02:05 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 02:05 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-11 02:05 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 02:05 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-11 02:05 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-11 02:05 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 02:05 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 02:05 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 02:05 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-11 02:05 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 02:05 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 02:05 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-11 02:05 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-11 02:05 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 02:05 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 02:05 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-11 02:05 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-11 02:05 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-11 02:05 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 02:05 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-11 02:05 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-11 02:05 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 02:05 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 02:05 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-11 02:05 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-11 02:05 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 02:05 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 02:05 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 02:05 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 02:05 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 02:05 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 02:05 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 02:05 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 02:05 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 02:05 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 02:05 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 02:05 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 02:05 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 02:05 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 02:05 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 02:05 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 02:05 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-11 02:05 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-11 02:05 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 02:03 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 02:03 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 02:44 - 2014-06-06 02:45 - 00000000 ____D () C:\Users\Meriem\Desktop\Darbuka_files
2014-06-06 02:44 - 2014-06-06 02:44 - 00080355 _____ () C:\Users\Meriem\Desktop\Darbuka.htm
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Mnemosyne
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\.matplotlib
2014-06-05 14:33 - 2014-06-05 14:34 - 25784542 _____ ( ) C:\Users\Meriem\Downloads\mnemosyne-2.3-setup.exe
2014-06-05 14:27 - 2014-06-05 14:27 - 00000000 _____ () C:\Users\Meriem\Downloads\memorylifter_21362.exe
2014-06-03 03:03 - 2014-06-03 03:03 - 00038799 _____ () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest.htm
2014-06-03 03:03 - 2014-06-03 03:03 - 00000000 ____D () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest_files
2014-06-03 01:59 - 2014-06-03 02:00 - 09437951 _____ () C:\Users\Meriem\Downloads\krone-scheibenmaeher.wmv
2014-05-28 23:38 - 2014-05-28 23:38 - 00000000 ____D () C:\Users\Meriem\AppData\Local\com
2014-05-28 23:33 - 2014-05-28 23:33 - 00809488 _____ () C:\Users\Meriem\Downloads\Player_Setup.exe
2014-05-28 18:43 - 2014-05-28 18:43 - 00501248 _____ (Facebook Inc.) C:\Users\Meriem\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
2014-05-28 00:11 - 2014-06-03 00:16 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Spotify
2014-05-28 00:11 - 2014-05-28 00:11 - 00001811 _____ () C:\Users\Meriem\Desktop\Spotify.lnk
2014-05-28 00:11 - 2014-05-28 00:11 - 00001797 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-05-28 00:09 - 2014-06-03 21:07 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Spotify
2014-05-28 00:09 - 2014-05-28 00:09 - 00126112 _____ (Spotify Ltd) C:\Users\Meriem\Downloads\SpotifySetup_0.9.10.14.exe
2014-05-25 13:13 - 2014-05-25 13:13 - 00000000 ____D () C:\Program Files (x86)\ShowMyPCService
2014-05-25 13:09 - 2014-05-25 13:10 - 02146552 _____ () C:\Users\Meriem\Desktop\ShowMyPC3160.exe
2014-05-25 02:36 - 2014-05-25 02:36 - 01095461 _____ (pendrivelinux.com) C:\Users\Meriem\Downloads\Universal-USB-Installer-1.9.5.2.exe
2014-05-25 02:34 - 2014-05-25 02:45 - 957349888 ____R () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso
2014-05-25 02:34 - 2014-05-25 02:34 - 00036747 _____ () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso.torrent
2014-05-25 02:15 - 2014-05-25 02:16 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-05-25 02:15 - 2014-05-25 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2014-05-25 02:15 - 2013-03-21 12:21 - 00217824 _____ (AppEx Networks Corporation) C:\Windows\system32\Drivers\appexDrv.sys
2014-05-25 02:15 - 2012-08-28 20:27 - 00058536 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2014-05-25 02:06 - 2014-05-25 02:06 - 00000000 ____D () C:\Windows\SysWOW64\sda
2014-05-25 02:04 - 2013-01-15 17:37 - 09889352 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsUVStoricon.dll
2014-05-25 02:04 - 2013-01-15 17:37 - 00327240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsUVStor.sys
2014-05-25 02:03 - 2014-05-25 02:07 - 445336096 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\avga141w7.exe
2014-05-25 02:03 - 2014-05-25 02:03 - 06450792 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\cr159w7.exe
2014-05-25 01:58 - 2014-05-25 01:59 - 00000000 ____D () C:\Program Files (x86)\LinuxLive USB Creator
2014-05-25 01:58 - 2014-05-25 01:58 - 04999949 _____ (LinuxLive USB Creator) C:\Users\Meriem\Downloads\LinuxLive_USB_Creator_2.8.28.exe
2014-05-25 01:58 - 2014-05-25 01:58 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LinuxLive USB Creator
2014-05-25 01:33 - 2014-05-25 01:33 - 00000183 _____ () C:\Users\Meriem\Downloads\130827_rockenheim_tenaciousd_fes.mov
2014-05-25 01:22 - 2014-06-06 13:43 - 00000000 ____D () C:\Users\Meriem\Desktop\krims
2014-05-25 00:49 - 2014-05-25 00:49 - 00000000 ____D () C:\Users\Meriem\Downloads\The Lego Movie (2014) BLU-RAY [Heartbleed]
2014-05-25 00:17 - 2014-05-25 00:33 - 1010827264 _____ () C:\Users\Meriem\Downloads\ubuntu-14.04-desktop-amd64.iso
2014-05-22 13:48 - 2014-06-16 23:40 - 00000000 ____D () C:\AdwCleaner
2014-05-22 13:48 - 2014-05-22 13:48 - 01326389 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.210.exe
2014-05-22 13:16 - 2014-05-22 13:17 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86.zip
2014-05-22 13:16 - 2014-05-22 13:17 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86 (1).zip
2014-05-22 02:43 - 2014-05-22 02:43 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-05-18 14:54 - 2014-05-18 14:54 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 14:54 - 2014-05-18 14:54 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-18 14:53 - 2014-05-18 14:53 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-18 14:52 - 2014-05-18 14:57 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-18 14:50 - 2014-05-18 14:56 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Adobe
2014-05-18 14:45 - 2014-05-18 14:45 - 00022792 _____ () C:\Users\Meriem\Desktop\Fragen + Antworten Skript.odt

==================== One Month Modified Files and Folders =======

2014-06-17 01:05 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Temp
2014-06-17 01:05 - 2014-06-15 22:20 - 00012723 _____ () C:\Users\Meriem\Downloads\FRST.txt
2014-06-17 01:04 - 2014-06-15 22:19 - 00000000 ____D () C:\FRST
2014-06-17 01:01 - 2014-04-19 23:31 - 01274255 _____ () C:\Windows\WindowsUpdate.log
2014-06-17 01:01 - 2011-04-12 09:43 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-06-17 01:01 - 2011-04-12 09:43 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-06-17 01:01 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-17 00:57 - 2014-06-17 00:24 - 00006411 _____ () C:\zoek-results.log
2014-06-17 00:56 - 2014-06-13 18:21 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-17 00:56 - 2010-11-21 05:47 - 00262314 _____ () C:\Windows\PFRO.log
2014-06-17 00:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-17 00:56 - 2009-07-14 06:51 - 00044392 _____ () C:\Windows\setupact.log
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-17 00:44 - 2014-06-17 00:22 - 00000000 ____D () C:\zoek_backup
2014-06-17 00:26 - 2014-06-13 18:21 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-17 00:22 - 2014-06-17 00:55 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-06-17 00:22 - 2014-06-17 00:22 - 01285120 _____ () C:\Users\Meriem\Downloads\zoek.exe
2014-06-17 00:17 - 2014-05-15 20:45 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-16 23:50 - 2014-06-16 23:50 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-16 23:48 - 2014-06-16 23:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Meriem\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-16 23:40 - 2014-05-22 13:48 - 00000000 ____D () C:\AdwCleaner
2014-06-16 23:38 - 2014-06-16 23:37 - 01333465 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.212.exe
2014-06-16 16:01 - 2014-04-19 18:53 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-06-16 15:01 - 2014-06-16 15:01 - 00025408 _____ () C:\ComboFix.txt
2014-06-16 15:01 - 2014-06-16 13:52 - 00000000 ____D () C:\Qoobox
2014-06-16 14:54 - 2014-06-16 13:52 - 00000000 ____D () C:\Windows\erdnt
2014-06-16 14:52 - 2014-06-16 14:52 - 00000728 __RSH () C:\ProgramData\ntuser.pol
2014-06-16 14:51 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-16 14:51 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-16 13:50 - 2014-06-16 13:50 - 05206841 ____R (Swearware) C:\Users\Meriem\Desktop\ComboFix.exe
2014-06-15 22:30 - 2014-06-15 22:23 - 00027769 _____ () C:\Users\Meriem\Downloads\Addition.txt
2014-06-15 22:19 - 2014-06-15 22:19 - 02081280 _____ (Farbar) C:\Users\Meriem\Downloads\FRST64.exe
2014-06-15 16:24 - 2014-04-20 00:00 - 00000000 ____D () C:\Users\Meriem\AppData\Local\VirtualStore
2014-06-13 19:56 - 2014-06-13 19:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-06-13 19:48 - 2014-06-13 19:41 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-13 19:43 - 2014-06-13 19:43 - 00002213 _____ () C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002205 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00002193 _____ () C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-06-13 19:43 - 2014-06-13 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2014
2014-06-13 19:43 - 2014-06-13 19:42 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\TuneUp Software
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Local\TuneUp Software
2014-06-13 19:40 - 2014-06-13 19:39 - 27883432 _____ (TuneUp Software) C:\Users\Meriem\Downloads\TuneUpUtilities2014_de-DE.exe
2014-06-13 19:02 - 2014-06-13 17:34 - 00010925 _____ () C:\Users\Meriem\Downloads\hijackthis.log
2014-06-13 19:01 - 2014-06-13 19:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Meriem\Downloads\hijackthis_5833.exe
2014-06-13 18:23 - 2014-06-13 18:23 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-13 18:23 - 2014-06-13 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-13 18:21 - 2014-06-13 18:21 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-13 18:21 - 2014-06-13 18:21 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-13 18:21 - 2014-04-20 00:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-13 18:17 - 2014-06-13 18:17 - 00918672 _____ (Google Inc.) C:\Users\Meriem\Downloads\ChromeSetup.exe
2014-06-13 18:11 - 2014-04-20 00:01 - 00000997 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-13 12:01 - 2014-06-13 01:28 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-13 01:30 - 2014-06-13 01:28 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-13 01:29 - 2014-06-13 01:29 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-13 01:25 - 2014-06-13 01:23 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Meriem\Downloads\spybot-2.3.exe
2014-06-13 01:20 - 2014-06-13 01:20 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Meriem\Downloads\SpyHunter-Installer (2).exe
2014-06-13 00:26 - 2009-07-14 04:34 - 00000580 _____ () C:\Windows\win.ini
2014-06-13 00:04 - 2014-06-12 22:01 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Skype
2014-06-13 00:03 - 2009-07-14 06:45 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-13 00:03 - 2009-07-14 06:45 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 22:02 - 2014-06-12 22:02 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-06-12 22:01 - 2014-06-12 22:00 - 00000000 ____D () C:\ProgramData\Skype
2014-06-12 21:59 - 2014-06-12 21:59 - 00123392 _____ () C:\Windows\system32\DlProtectSvc.exe
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2014-06-12 21:56 - 2014-06-12 21:56 - 00469376 _____ () C:\Users\Meriem\Downloads\skype.exe
2014-06-11 03:12 - 2014-05-16 01:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 03:09 - 2014-05-16 01:12 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 03:09 - 2014-04-20 15:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 03:03 - 2014-05-07 00:59 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 22:34 - 2014-05-16 17:27 - 00000000 ____D () C:\Users\Meriem\Desktop\UNI
2014-06-09 12:10 - 2014-06-12 23:03 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
2014-06-08 11:13 - 2014-06-11 02:03 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 02:03 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 13:56 - 2014-05-07 21:10 - 00000000 ____D () C:\Users\Meriem\Desktop\PICS
2014-06-06 13:43 - 2014-05-25 01:22 - 00000000 ____D () C:\Users\Meriem\Desktop\krims
2014-06-06 02:45 - 2014-06-06 02:44 - 00000000 ____D () C:\Users\Meriem\Desktop\Darbuka_files
2014-06-06 02:44 - 2014-06-06 02:44 - 00080355 _____ () C:\Users\Meriem\Desktop\Darbuka.htm
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Mnemosyne
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\.matplotlib
2014-06-05 14:39 - 2014-04-20 00:00 - 00000000 ____D () C:\Users\Meriem
2014-06-05 14:34 - 2014-06-05 14:33 - 25784542 _____ ( ) C:\Users\Meriem\Downloads\mnemosyne-2.3-setup.exe
2014-06-05 14:27 - 2014-06-05 14:27 - 00000000 _____ () C:\Users\Meriem\Downloads\memorylifter_21362.exe
2014-06-03 21:07 - 2014-05-28 00:09 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Spotify
2014-06-03 03:03 - 2014-06-03 03:03 - 00038799 _____ () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest.htm
2014-06-03 03:03 - 2014-06-03 03:03 - 00000000 ____D () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest_files
2014-06-03 02:00 - 2014-06-03 01:59 - 09437951 _____ () C:\Users\Meriem\Downloads\krone-scheibenmaeher.wmv
2014-06-03 00:27 - 2014-04-20 00:01 - 00000000 ___RD () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-03 00:16 - 2014-05-28 00:11 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Spotify
2014-05-30 12:21 - 2014-06-11 02:05 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 12:02 - 2014-06-11 02:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 12:02 - 2014-06-11 02:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 11:45 - 2014-06-11 02:05 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 11:39 - 2014-06-11 02:05 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 11:39 - 2014-06-11 02:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 11:38 - 2014-06-11 02:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 11:28 - 2014-06-11 02:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 11:27 - 2014-06-11 02:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 11:24 - 2014-06-11 02:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 11:21 - 2014-06-11 02:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 11:21 - 2014-06-11 02:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 11:20 - 2014-06-11 02:05 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 11:18 - 2014-06-11 02:05 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-30 11:11 - 2014-06-11 02:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 11:08 - 2014-06-11 02:05 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 11:06 - 2014-06-11 02:05 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 11:02 - 2014-06-11 02:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-30 10:55 - 2014-06-11 02:05 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:49 - 2014-06-11 02:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:46 - 2014-06-11 02:05 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:44 - 2014-06-11 02:05 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-30 10:44 - 2014-06-11 02:05 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 10:43 - 2014-06-11 02:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-30 10:42 - 2014-06-11 02:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-11 02:05 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-30 10:35 - 2014-06-11 02:05 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 10:34 - 2014-06-11 02:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-30 10:33 - 2014-06-11 02:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-30 10:30 - 2014-06-11 02:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-30 10:29 - 2014-06-11 02:05 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 10:28 - 2014-06-11 02:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-30 10:27 - 2014-06-11 02:05 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-30 10:24 - 2014-06-11 02:05 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 10:23 - 2014-06-11 02:05 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 10:16 - 2014-06-11 02:05 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-30 10:10 - 2014-06-11 02:05 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-11 02:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-30 10:04 - 2014-06-11 02:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-30 10:02 - 2014-06-11 02:05 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-30 09:56 - 2014-06-11 02:05 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-30 09:56 - 2014-06-11 02:05 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:54 - 2014-06-11 02:05 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-30 09:50 - 2014-06-11 02:05 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-11 02:05 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-30 09:43 - 2014-06-11 02:05 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:40 - 2014-06-11 02:05 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-30 09:30 - 2014-06-11 02:05 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:21 - 2014-06-11 02:05 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-30 09:15 - 2014-06-11 02:05 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-30 09:13 - 2014-06-11 02:05 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 09:13 - 2014-06-11 02:05 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-28 23:38 - 2014-05-28 23:38 - 00000000 ____D () C:\Users\Meriem\AppData\Local\com
2014-05-28 23:33 - 2014-05-28 23:33 - 00809488 _____ () C:\Users\Meriem\Downloads\Player_Setup.exe
2014-05-28 18:43 - 2014-05-28 18:43 - 00501248 _____ (Facebook Inc.) C:\Users\Meriem\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
2014-05-28 00:11 - 2014-05-28 00:11 - 00001811 _____ () C:\Users\Meriem\Desktop\Spotify.lnk
2014-05-28 00:11 - 2014-05-28 00:11 - 00001797 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-05-28 00:09 - 2014-05-28 00:09 - 00126112 _____ (Spotify Ltd) C:\Users\Meriem\Downloads\SpotifySetup_0.9.10.14.exe
2014-05-25 13:13 - 2014-05-25 13:13 - 00000000 ____D () C:\Program Files (x86)\ShowMyPCService
2014-05-25 13:10 - 2014-05-25 13:09 - 02146552 _____ () C:\Users\Meriem\Desktop\ShowMyPC3160.exe
2014-05-25 02:45 - 2014-05-25 02:34 - 957349888 ____R () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso
2014-05-25 02:45 - 2014-04-20 15:03 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\uTorrent
2014-05-25 02:36 - 2014-05-25 02:36 - 01095461 _____ (pendrivelinux.com) C:\Users\Meriem\Downloads\Universal-USB-Installer-1.9.5.2.exe
2014-05-25 02:34 - 2014-05-25 02:34 - 00036747 _____ () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso.torrent
2014-05-25 02:16 - 2014-05-25 02:15 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-05-25 02:15 - 2014-05-25 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2014-05-25 02:10 - 2014-04-20 11:36 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\vlc
2014-05-25 02:07 - 2014-05-25 02:03 - 445336096 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\avga141w7.exe
2014-05-25 02:06 - 2014-05-25 02:06 - 00000000 ____D () C:\Windows\SysWOW64\sda
2014-05-25 02:04 - 2014-04-20 00:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-25 02:04 - 2014-04-19 18:34 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-25 02:03 - 2014-05-25 02:03 - 06450792 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\cr159w7.exe
2014-05-25 01:59 - 2014-05-25 01:58 - 00000000 ____D () C:\Program Files (x86)\LinuxLive USB Creator
2014-05-25 01:58 - 2014-05-25 01:58 - 04999949 _____ (LinuxLive USB Creator) C:\Users\Meriem\Downloads\LinuxLive_USB_Creator_2.8.28.exe
2014-05-25 01:58 - 2014-05-25 01:58 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LinuxLive USB Creator
2014-05-25 01:33 - 2014-05-25 01:33 - 00000183 _____ () C:\Users\Meriem\Downloads\130827_rockenheim_tenaciousd_fes.mov
2014-05-25 00:49 - 2014-05-25 00:49 - 00000000 ____D () C:\Users\Meriem\Downloads\The Lego Movie (2014) BLU-RAY [Heartbleed]
2014-05-25 00:33 - 2014-05-25 00:17 - 1010827264 _____ () C:\Users\Meriem\Downloads\ubuntu-14.04-desktop-amd64.iso
2014-05-25 00:02 - 2010-11-21 05:24 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-05-25 00:02 - 2010-11-21 05:23 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-05-22 13:48 - 2014-05-22 13:48 - 01326389 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.210.exe
2014-05-22 13:17 - 2014-05-22 13:16 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86.zip
2014-05-22 13:17 - 2014-05-22 13:16 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86 (1).zip
2014-05-22 12:57 - 2014-04-19 22:47 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-22 12:57 - 2014-04-19 22:47 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-22 02:43 - 2014-05-22 02:43 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-05-21 15:59 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-05-20 21:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-18 14:57 - 2014-05-18 14:52 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-18 14:56 - 2014-05-18 14:50 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Adobe
2014-05-18 14:56 - 2014-04-22 14:15 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Adobe
2014-05-18 14:54 - 2014-05-18 14:54 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 14:54 - 2014-05-18 14:54 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-18 14:53 - 2014-05-18 14:53 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-18 14:45 - 2014-05-18 14:45 - 00022792 _____ () C:\Users\Meriem\Desktop\Fragen + Antworten Skript.odt

Some content of TEMP:
====================
C:\Users\Meriem\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-11 18:13

==================== End Of Log ============================
         

--- --- ---

--- --- ---

So geht es weiter:




Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

start
FF HKLM-x32\...\Firefox\Extensions: [{6D752195-EBEB-4A41-9BBF-C28460214255}] - C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi [2014-06-16]
C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}
R2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [123392 2014-06-12] () [File not signed]
C:\Windows\System32\DlProtectSvc.exe
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-06-09] (StdLib)
C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
C:\Program Files\Enigma Software Group
C:\Users\Meriem\Downloads\SpyHunter*.exe
Task: {32A368A6-44B3-4A2E-9466-EE7F342E072C} - \SomotoUpdateCheckerAutoStart No Task File <==== ATTENTION
Task: {9F10D918-6EAC-4135-9CC4-BBEA8D83DD07} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Reboot:
end
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Schritt 2

• Starte die FRST.exe erneut. Setze einen Haken vor Addition und drücke auf Scan.
• FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
• Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

• die Logdatei des FRST-Fix,
• die beiden Logdateien des FRST-Suchlaufs.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-06-2014
Ran by Meriem at 2014-06-17 14:38:13 Run:1
Running from C:\Users\Meriem\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
FF HKLM-x32\...\Firefox\Extensions: [{6D752195-EBEB-4A41-9BBF-C28460214255}] - C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi [2014-06-16]
C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}
R2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [123392 2014-06-12] () [File not signed]
C:\Windows\System32\DlProtectSvc.exe
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64; C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys [61120 2014-06-09] (StdLib)
C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
C:\Program Files\Enigma Software Group
C:\Users\Meriem\Downloads\SpyHunter*.exe
Task: {32A368A6-44B3-4A2E-9466-EE7F342E072C} - \SomotoUpdateCheckerAutoStart No Task File <==== ATTENTION
Task: {9F10D918-6EAC-4135-9CC4-BBEA8D83DD07} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Reboot:
end
*****************

HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{6D752195-EBEB-4A41-9BBF-C28460214255} => value deleted successfully.
C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B}\{6D752195-EBEB-4A41-9BBF-C28460214255}.xpi => Moved successfully.
C:\Windows\Installer\{896A5283-05BE-4EDB-9C4C-80E4ACF0434B} => Moved successfully.
DlProtectSvc => Service stopped successfully.
DlProtectSvc => Service deleted successfully.
C:\Windows\System32\DlProtectSvc.exe => Moved successfully.
{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64 => Service stopped successfully.
{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64 => Service deleted successfully.
C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys => Moved successfully.
esgiguard => Service deleted successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
C:\Users\Meriem\Downloads\SpyHunter*.exe => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{32A368A6-44B3-4A2E-9466-EE7F342E072C}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{32A368A6-44B3-4A2E-9466-EE7F342E072C}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SomotoUpdateCheckerAutoStart' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9F10D918-6EAC-4135-9CC4-BBEA8D83DD07}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9F10D918-6EAC-4135-9CC4-BBEA8D83DD07}' => Key deleted successfully.
C:\Windows\System32\Tasks\SpyHunter4Startup => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpyHunter4Startup' => Key deleted successfully.
'HKLM\SOFTWARE\Policies\Google' => Key deleted successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.


The system needed a reboot. 

==== End of Fixlog ====
         

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-06-2014
Ran by Meriem (administrator) on MERIEM-PC on 17-06-2014 14:42:13
Running from C:\Users\Meriem\Downloads
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AMDQuickStream.exe
(Spotify Ltd) C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
() C:\Windows\System32\PerfCfnterCPL.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6346464 2013-01-04] (Realtek semiconductor)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2014-04-19] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2014-04-19] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\EnergyCut\utilty.exe [1581056 2007-04-27] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [EnergyCut] => C:\Program Files (x86)\Lenovo\EnergyCut\EnergyCut.exe [1167360 2007-03-09] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [182352 2014-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [429792 2013-02-08] (AppEx Networks Corporation)
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-2847094928-2611277413-3262722226-1000\...\Run: [Spotify Web Helper] => C:\Users\Meriem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-28] (Spotify Ltd)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.1.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Meriem\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-13]
CHR Extension: (Google Drive) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-13]
CHR Extension: (YouTube) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-13]
CHR Extension: (Google-Suche) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-13]
CHR Extension: (Google Wallet) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-13]
CHR Extension: (Google Mail) - C:\Users\Meriem\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-13]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-22] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [124496 2014-05-05] (Avira Operations GmbH & Co. KG)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 xcopy64; C:\Windows\system32\PerfCfnterCPL.exe [119296 2014-06-12] () [File not signed]

==================== Drivers (Whitelisted) ====================

R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [217824 2013-03-21] (AppEx Networks Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-19] (Disc Soft Ltd)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-04] (Realtek Semiconductor Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-17 00:55 - 2014-06-17 14:42 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:22 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-06-17 00:24 - 2014-06-17 00:57 - 00006411 _____ () C:\zoek-results.log
2014-06-17 00:22 - 2014-06-17 00:44 - 00000000 ____D () C:\zoek_backup
2014-06-17 00:22 - 2014-06-17 00:22 - 01285120 _____ () C:\Users\Meriem\Downloads\zoek.exe
2014-06-16 23:50 - 2014-06-16 23:50 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-16 23:50 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-16 23:50 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-16 23:50 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-16 23:48 - 2014-06-16 23:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Meriem\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-16 23:37 - 2014-06-16 23:38 - 01333465 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.212.exe
2014-06-16 15:01 - 2014-06-16 15:01 - 00025408 _____ () C:\ComboFix.txt
2014-06-16 14:52 - 2014-06-17 14:39 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-16 14:02 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-16 14:02 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-16 14:02 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-16 14:02 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-16 13:52 - 2014-06-16 15:01 - 00000000 ____D () C:\Qoobox
2014-06-16 13:52 - 2014-06-16 14:54 - 00000000 ____D () C:\Windows\erdnt
2014-06-16 13:50 - 2014-06-16 13:50 - 05206841 ____R (Swearware) C:\Users\Meriem\Desktop\ComboFix.exe
2014-06-15 22:23 - 2014-06-17 01:07 - 00028727 _____ () C:\Users\Meriem\Downloads\Addition.txt
2014-06-15 22:20 - 2014-06-17 14:42 - 00011275 _____ () C:\Users\Meriem\Downloads\FRST.txt
2014-06-15 22:19 - 2014-06-17 14:42 - 00000000 ____D () C:\FRST
2014-06-15 22:19 - 2014-06-15 22:19 - 02081280 _____ (Farbar) C:\Users\Meriem\Downloads\FRST64.exe
2014-06-13 19:56 - 2014-06-13 19:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\TuneUp Software
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Local\TuneUp Software
2014-06-13 19:41 - 2014-06-13 19:48 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-13 19:01 - 2014-06-13 19:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Meriem\Downloads\hijackthis_5833.exe
2014-06-13 18:23 - 2014-06-13 18:23 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-13 18:23 - 2014-06-13 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-13 18:21 - 2014-06-17 14:39 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 18:21 - 2014-06-17 14:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 18:21 - 2014-06-17 13:14 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-13 18:21 - 2014-06-17 13:13 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-13 18:17 - 2014-06-13 18:17 - 00918672 _____ (Google Inc.) C:\Users\Meriem\Downloads\ChromeSetup.exe
2014-06-13 17:34 - 2014-06-13 19:02 - 00010925 _____ () C:\Users\Meriem\Downloads\hijackthis.log
2014-06-13 12:04 - 2009-06-10 23:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20140613-120430.backup
2014-06-13 01:29 - 2014-06-13 01:29 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-13 01:28 - 2014-06-13 12:01 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-13 01:28 - 2014-06-13 01:30 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-13 01:28 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-06-13 01:23 - 2014-06-13 01:25 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Meriem\Downloads\spybot-2.3.exe
2014-06-12 22:02 - 2014-06-12 22:02 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Skype
2014-06-12 22:01 - 2014-06-13 00:04 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-06-12 22:00 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Skype
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2014-06-12 21:56 - 2014-06-12 21:56 - 00469376 _____ () C:\Users\Meriem\Downloads\skype.exe
2014-06-11 02:05 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 02:05 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 02:05 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 02:05 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 02:05 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 02:05 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 02:05 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 02:05 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 02:05 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 02:05 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 02:05 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 02:05 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 02:05 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 02:05 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 02:05 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 02:05 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 02:05 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 02:05 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 02:05 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 02:05 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 02:05 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 02:05 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-11 02:05 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 02:05 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-11 02:05 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-11 02:05 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 02:05 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 02:05 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 02:05 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-11 02:05 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-11 02:05 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 02:05 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-11 02:05 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-11 02:05 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 02:05 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 02:05 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-11 02:05 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-11 02:05 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-11 02:05 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 02:05 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-11 02:05 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-11 02:05 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 02:05 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 02:05 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-11 02:05 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-11 02:05 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 02:05 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 02:05 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 02:05 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 02:05 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 02:05 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 02:05 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-11 02:05 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 02:05 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-11 02:05 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 02:05 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 02:05 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 02:05 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 02:05 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 02:05 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 02:05 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-11 02:05 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-11 02:05 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-11 02:05 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 02:03 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 02:03 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 02:44 - 2014-06-06 02:45 - 00000000 ____D () C:\Users\Meriem\Desktop\Darbuka_files
2014-06-06 02:44 - 2014-06-06 02:44 - 00080355 _____ () C:\Users\Meriem\Desktop\Darbuka.htm
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Mnemosyne
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\.matplotlib
2014-06-05 14:33 - 2014-06-05 14:34 - 25784542 _____ ( ) C:\Users\Meriem\Downloads\mnemosyne-2.3-setup.exe
2014-06-05 14:27 - 2014-06-05 14:27 - 00000000 _____ () C:\Users\Meriem\Downloads\memorylifter_21362.exe
2014-06-03 03:03 - 2014-06-03 03:03 - 00038799 _____ () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest.htm
2014-06-03 03:03 - 2014-06-03 03:03 - 00000000 ____D () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest_files
2014-06-03 01:59 - 2014-06-03 02:00 - 09437951 _____ () C:\Users\Meriem\Downloads\krone-scheibenmaeher.wmv
2014-05-28 23:38 - 2014-05-28 23:38 - 00000000 ____D () C:\Users\Meriem\AppData\Local\com
2014-05-28 23:33 - 2014-05-28 23:33 - 00809488 _____ () C:\Users\Meriem\Downloads\Player_Setup.exe
2014-05-28 18:43 - 2014-05-28 18:43 - 00501248 _____ (Facebook Inc.) C:\Users\Meriem\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
2014-05-28 00:11 - 2014-06-03 00:16 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Spotify
2014-05-28 00:11 - 2014-05-28 00:11 - 00001811 _____ () C:\Users\Meriem\Desktop\Spotify.lnk
2014-05-28 00:11 - 2014-05-28 00:11 - 00001797 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-05-28 00:09 - 2014-06-03 21:07 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Spotify
2014-05-28 00:09 - 2014-05-28 00:09 - 00126112 _____ (Spotify Ltd) C:\Users\Meriem\Downloads\SpotifySetup_0.9.10.14.exe
2014-05-25 13:13 - 2014-05-25 13:13 - 00000000 ____D () C:\Program Files (x86)\ShowMyPCService
2014-05-25 13:09 - 2014-05-25 13:10 - 02146552 _____ () C:\Users\Meriem\Desktop\ShowMyPC3160.exe
2014-05-25 02:36 - 2014-05-25 02:36 - 01095461 _____ (pendrivelinux.com) C:\Users\Meriem\Downloads\Universal-USB-Installer-1.9.5.2.exe
2014-05-25 02:34 - 2014-05-25 02:45 - 957349888 ____R () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso
2014-05-25 02:34 - 2014-05-25 02:34 - 00036747 _____ () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso.torrent
2014-05-25 02:15 - 2014-05-25 02:16 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-05-25 02:15 - 2014-05-25 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2014-05-25 02:15 - 2013-03-21 12:21 - 00217824 _____ (AppEx Networks Corporation) C:\Windows\system32\Drivers\appexDrv.sys
2014-05-25 02:15 - 2012-08-28 20:27 - 00058536 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2014-05-25 02:06 - 2014-05-25 02:06 - 00000000 ____D () C:\Windows\SysWOW64\sda
2014-05-25 02:04 - 2013-01-15 17:37 - 09889352 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsUVStoricon.dll
2014-05-25 02:04 - 2013-01-15 17:37 - 00327240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsUVStor.sys
2014-05-25 02:03 - 2014-05-25 02:07 - 445336096 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\avga141w7.exe
2014-05-25 02:03 - 2014-05-25 02:03 - 06450792 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\cr159w7.exe
2014-05-25 01:58 - 2014-05-25 01:59 - 00000000 ____D () C:\Program Files (x86)\LinuxLive USB Creator
2014-05-25 01:58 - 2014-05-25 01:58 - 04999949 _____ (LinuxLive USB Creator) C:\Users\Meriem\Downloads\LinuxLive_USB_Creator_2.8.28.exe
2014-05-25 01:58 - 2014-05-25 01:58 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LinuxLive USB Creator
2014-05-25 01:33 - 2014-05-25 01:33 - 00000183 _____ () C:\Users\Meriem\Downloads\130827_rockenheim_tenaciousd_fes.mov
2014-05-25 01:22 - 2014-06-06 13:43 - 00000000 ____D () C:\Users\Meriem\Desktop\krims
2014-05-25 00:49 - 2014-05-25 00:49 - 00000000 ____D () C:\Users\Meriem\Downloads\The Lego Movie (2014) BLU-RAY [Heartbleed]
2014-05-25 00:17 - 2014-05-25 00:33 - 1010827264 _____ () C:\Users\Meriem\Downloads\ubuntu-14.04-desktop-amd64.iso
2014-05-22 13:48 - 2014-06-16 23:40 - 00000000 ____D () C:\AdwCleaner
2014-05-22 13:48 - 2014-05-22 13:48 - 01326389 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.210.exe
2014-05-22 13:16 - 2014-05-22 13:17 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86.zip
2014-05-22 13:16 - 2014-05-22 13:17 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86 (1).zip
2014-05-22 02:43 - 2014-05-22 02:43 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-05-18 14:54 - 2014-05-18 14:54 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 14:54 - 2014-05-18 14:54 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-18 14:53 - 2014-05-18 14:53 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-18 14:52 - 2014-05-18 14:57 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-18 14:50 - 2014-05-18 14:56 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Adobe
2014-05-18 14:45 - 2014-05-18 14:45 - 00022792 _____ () C:\Users\Meriem\Desktop\Fragen + Antworten Skript.odt

==================== One Month Modified Files and Folders =======

2014-06-17 14:42 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Temp
2014-06-17 14:42 - 2014-06-15 22:20 - 00011275 _____ () C:\Users\Meriem\Downloads\FRST.txt
2014-06-17 14:42 - 2014-06-15 22:19 - 00000000 ____D () C:\FRST
2014-06-17 14:39 - 2014-06-16 14:52 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-06-17 14:39 - 2014-06-13 18:21 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-17 14:39 - 2010-11-21 05:47 - 00263470 _____ () C:\Windows\PFRO.log
2014-06-17 14:39 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-17 14:39 - 2009-07-14 06:51 - 00044560 _____ () C:\Windows\setupact.log
2014-06-17 14:38 - 2014-04-19 23:31 - 01278863 _____ () C:\Windows\WindowsUpdate.log
2014-06-17 14:38 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-17 14:19 - 2014-06-13 18:21 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-17 13:14 - 2014-06-13 18:21 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-17 13:13 - 2014-06-13 18:21 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-17 09:00 - 2014-04-19 18:53 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-06-17 01:07 - 2014-06-15 22:23 - 00028727 _____ () C:\Users\Meriem\Downloads\Addition.txt
2014-06-17 01:01 - 2011-04-12 09:43 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-06-17 01:01 - 2011-04-12 09:43 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-06-17 01:01 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-17 00:57 - 2014-06-17 00:24 - 00006411 _____ () C:\zoek-results.log
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-17 00:55 - 2014-06-17 00:55 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-17 00:44 - 2014-06-17 00:22 - 00000000 ____D () C:\zoek_backup
2014-06-17 00:22 - 2014-06-17 00:55 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-06-17 00:22 - 2014-06-17 00:22 - 01285120 _____ () C:\Users\Meriem\Downloads\zoek.exe
2014-06-17 00:17 - 2014-05-15 20:45 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-16 23:50 - 2014-06-16 23:50 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-16 23:48 - 2014-06-16 23:48 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Meriem\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-16 23:40 - 2014-05-22 13:48 - 00000000 ____D () C:\AdwCleaner
2014-06-16 23:38 - 2014-06-16 23:37 - 01333465 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.212.exe
2014-06-16 15:01 - 2014-06-16 15:01 - 00025408 _____ () C:\ComboFix.txt
2014-06-16 15:01 - 2014-06-16 13:52 - 00000000 ____D () C:\Qoobox
2014-06-16 14:54 - 2014-06-16 13:52 - 00000000 ____D () C:\Windows\erdnt
2014-06-16 14:51 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-16 13:50 - 2014-06-16 13:50 - 05206841 ____R (Swearware) C:\Users\Meriem\Desktop\ComboFix.exe
2014-06-15 22:19 - 2014-06-15 22:19 - 02081280 _____ (Farbar) C:\Users\Meriem\Downloads\FRST64.exe
2014-06-15 16:24 - 2014-04-20 00:00 - 00000000 ____D () C:\Users\Meriem\AppData\Local\VirtualStore
2014-06-13 19:56 - 2014-06-13 19:56 - 00003694 _____ () C:\Windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm
2014-06-13 19:48 - 2014-06-13 19:41 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\TuneUp Software
2014-06-13 19:42 - 2014-06-13 19:42 - 00000000 ____D () C:\Users\Meriem\AppData\Local\TuneUp Software
2014-06-13 19:02 - 2014-06-13 17:34 - 00010925 _____ () C:\Users\Meriem\Downloads\hijackthis.log
2014-06-13 19:01 - 2014-06-13 19:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Meriem\Downloads\hijackthis_5833.exe
2014-06-13 18:23 - 2014-06-13 18:23 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-13 18:23 - 2014-06-13 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-13 18:21 - 2014-04-20 00:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-13 18:17 - 2014-06-13 18:17 - 00918672 _____ (Google Inc.) C:\Users\Meriem\Downloads\ChromeSetup.exe
2014-06-13 18:11 - 2014-04-20 00:01 - 00000997 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-13 12:01 - 2014-06-13 01:28 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-13 01:30 - 2014-06-13 01:28 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-06-13 01:29 - 2014-06-13 01:29 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-06-13 01:29 - 2014-06-13 01:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-06-13 01:25 - 2014-06-13 01:23 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Meriem\Downloads\spybot-2.3.exe
2014-06-13 00:26 - 2009-07-14 04:34 - 00000580 _____ () C:\Windows\win.ini
2014-06-13 00:04 - 2014-06-12 22:01 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Skype
2014-06-13 00:03 - 2009-07-14 06:45 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-13 00:03 - 2009-07-14 06:45 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 22:02 - 2014-06-12 22:02 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-06-12 22:01 - 2014-06-12 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-06-12 22:01 - 2014-06-12 22:00 - 00000000 ____D () C:\ProgramData\Skype
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2014-06-12 21:56 - 2014-06-12 21:56 - 00469376 _____ () C:\Users\Meriem\Downloads\skype.exe
2014-06-11 03:12 - 2014-05-16 01:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 03:09 - 2014-05-16 01:12 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 03:09 - 2014-04-20 15:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 03:03 - 2014-05-07 00:59 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 22:34 - 2014-05-16 17:27 - 00000000 ____D () C:\Users\Meriem\Desktop\UNI
2014-06-08 11:13 - 2014-06-11 02:03 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 02:03 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 13:56 - 2014-05-07 21:10 - 00000000 ____D () C:\Users\Meriem\Desktop\PICS
2014-06-06 13:43 - 2014-05-25 01:22 - 00000000 ____D () C:\Users\Meriem\Desktop\krims
2014-06-06 02:45 - 2014-06-06 02:44 - 00000000 ____D () C:\Users\Meriem\Desktop\Darbuka_files
2014-06-06 02:44 - 2014-06-06 02:44 - 00080355 _____ () C:\Users\Meriem\Desktop\Darbuka.htm
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Mnemosyne
2014-06-05 14:39 - 2014-06-05 14:39 - 00000000 ____D () C:\Users\Meriem\.matplotlib
2014-06-05 14:39 - 2014-04-20 00:00 - 00000000 ____D () C:\Users\Meriem
2014-06-05 14:34 - 2014-06-05 14:33 - 25784542 _____ ( ) C:\Users\Meriem\Downloads\mnemosyne-2.3-setup.exe
2014-06-05 14:27 - 2014-06-05 14:27 - 00000000 _____ () C:\Users\Meriem\Downloads\memorylifter_21362.exe
2014-06-03 21:07 - 2014-05-28 00:09 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Spotify
2014-06-03 03:03 - 2014-06-03 03:03 - 00038799 _____ () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest.htm
2014-06-03 03:03 - 2014-06-03 03:03 - 00000000 ____D () C:\Users\Meriem\Desktop\TypenTest XL Persönlichkeitstest_files
2014-06-03 02:00 - 2014-06-03 01:59 - 09437951 _____ () C:\Users\Meriem\Downloads\krone-scheibenmaeher.wmv
2014-06-03 00:27 - 2014-04-20 00:01 - 00000000 ___RD () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-03 00:16 - 2014-05-28 00:11 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Spotify
2014-05-30 12:21 - 2014-06-11 02:05 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 12:02 - 2014-06-11 02:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 12:02 - 2014-06-11 02:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 11:45 - 2014-06-11 02:05 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 11:39 - 2014-06-11 02:05 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 11:39 - 2014-06-11 02:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 11:38 - 2014-06-11 02:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 11:28 - 2014-06-11 02:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 11:27 - 2014-06-11 02:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 11:24 - 2014-06-11 02:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 11:21 - 2014-06-11 02:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 11:21 - 2014-06-11 02:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 11:20 - 2014-06-11 02:05 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 11:18 - 2014-06-11 02:05 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-30 11:11 - 2014-06-11 02:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 11:08 - 2014-06-11 02:05 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 11:06 - 2014-06-11 02:05 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 11:02 - 2014-06-11 02:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-30 10:55 - 2014-06-11 02:05 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:49 - 2014-06-11 02:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:46 - 2014-06-11 02:05 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:44 - 2014-06-11 02:05 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-30 10:44 - 2014-06-11 02:05 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 10:43 - 2014-06-11 02:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-30 10:42 - 2014-06-11 02:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-11 02:05 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-30 10:35 - 2014-06-11 02:05 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 10:34 - 2014-06-11 02:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-30 10:33 - 2014-06-11 02:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-30 10:30 - 2014-06-11 02:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-30 10:29 - 2014-06-11 02:05 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 10:28 - 2014-06-11 02:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-30 10:27 - 2014-06-11 02:05 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-30 10:24 - 2014-06-11 02:05 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 10:23 - 2014-06-11 02:05 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 10:16 - 2014-06-11 02:05 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-30 10:10 - 2014-06-11 02:05 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-11 02:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-30 10:04 - 2014-06-11 02:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-30 10:02 - 2014-06-11 02:05 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-30 09:56 - 2014-06-11 02:05 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-30 09:56 - 2014-06-11 02:05 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:54 - 2014-06-11 02:05 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-30 09:50 - 2014-06-11 02:05 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-11 02:05 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-30 09:43 - 2014-06-11 02:05 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:40 - 2014-06-11 02:05 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-30 09:30 - 2014-06-11 02:05 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:21 - 2014-06-11 02:05 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-30 09:15 - 2014-06-11 02:05 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-30 09:13 - 2014-06-11 02:05 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 09:13 - 2014-06-11 02:05 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-28 23:38 - 2014-05-28 23:38 - 00000000 ____D () C:\Users\Meriem\AppData\Local\com
2014-05-28 23:33 - 2014-05-28 23:33 - 00809488 _____ () C:\Users\Meriem\Downloads\Player_Setup.exe
2014-05-28 18:43 - 2014-05-28 18:43 - 00501248 _____ (Facebook Inc.) C:\Users\Meriem\Downloads\FacebookVideoCallSetup_v1.2.205.0.exe
2014-05-28 00:11 - 2014-05-28 00:11 - 00001811 _____ () C:\Users\Meriem\Desktop\Spotify.lnk
2014-05-28 00:11 - 2014-05-28 00:11 - 00001797 _____ () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-05-28 00:09 - 2014-05-28 00:09 - 00126112 _____ (Spotify Ltd) C:\Users\Meriem\Downloads\SpotifySetup_0.9.10.14.exe
2014-05-25 13:13 - 2014-05-25 13:13 - 00000000 ____D () C:\Program Files (x86)\ShowMyPCService
2014-05-25 13:10 - 2014-05-25 13:09 - 02146552 _____ () C:\Users\Meriem\Desktop\ShowMyPC3160.exe
2014-05-25 02:45 - 2014-05-25 02:34 - 957349888 ____R () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso
2014-05-25 02:45 - 2014-04-20 15:03 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\uTorrent
2014-05-25 02:36 - 2014-05-25 02:36 - 01095461 _____ (pendrivelinux.com) C:\Users\Meriem\Downloads\Universal-USB-Installer-1.9.5.2.exe
2014-05-25 02:34 - 2014-05-25 02:34 - 00036747 _____ () C:\Users\Meriem\Downloads\xubuntu-14.04-desktop-amd64.iso.torrent
2014-05-25 02:16 - 2014-05-25 02:15 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-05-25 02:15 - 2014-05-25 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2014-05-25 02:10 - 2014-04-20 11:36 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\vlc
2014-05-25 02:07 - 2014-05-25 02:03 - 445336096 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\avga141w7.exe
2014-05-25 02:06 - 2014-05-25 02:06 - 00000000 ____D () C:\Windows\SysWOW64\sda
2014-05-25 02:04 - 2014-04-20 00:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-25 02:04 - 2014-04-19 18:34 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-25 02:03 - 2014-05-25 02:03 - 06450792 _____ (Lenovo Group Limited ) C:\Users\Meriem\Downloads\cr159w7.exe
2014-05-25 01:59 - 2014-05-25 01:58 - 00000000 ____D () C:\Program Files (x86)\LinuxLive USB Creator
2014-05-25 01:58 - 2014-05-25 01:58 - 04999949 _____ (LinuxLive USB Creator) C:\Users\Meriem\Downloads\LinuxLive_USB_Creator_2.8.28.exe
2014-05-25 01:58 - 2014-05-25 01:58 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LinuxLive USB Creator
2014-05-25 01:33 - 2014-05-25 01:33 - 00000183 _____ () C:\Users\Meriem\Downloads\130827_rockenheim_tenaciousd_fes.mov
2014-05-25 00:49 - 2014-05-25 00:49 - 00000000 ____D () C:\Users\Meriem\Downloads\The Lego Movie (2014) BLU-RAY [Heartbleed]
2014-05-25 00:33 - 2014-05-25 00:17 - 1010827264 _____ () C:\Users\Meriem\Downloads\ubuntu-14.04-desktop-amd64.iso
2014-05-25 00:02 - 2010-11-21 05:24 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-05-25 00:02 - 2010-11-21 05:24 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-05-25 00:02 - 2010-11-21 05:23 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-05-22 13:48 - 2014-05-22 13:48 - 01326389 _____ () C:\Users\Meriem\Downloads\adwcleaner_3.210.exe
2014-05-22 13:17 - 2014-05-22 13:16 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86.zip
2014-05-22 13:17 - 2014-05-22 13:16 - 00217871 _____ () C:\Users\Meriem\Downloads\ShellExView_1.86 (1).zip
2014-05-22 12:57 - 2014-04-19 22:47 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-22 12:57 - 2014-04-19 22:47 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-22 02:43 - 2014-05-22 02:43 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-05-21 15:59 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-05-20 21:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-18 14:57 - 2014-05-18 14:52 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-18 14:56 - 2014-05-18 14:50 - 00000000 ____D () C:\Users\Meriem\AppData\Local\Adobe
2014-05-18 14:56 - 2014-04-22 14:15 - 00000000 ____D () C:\Users\Meriem\AppData\Roaming\Adobe
2014-05-18 14:54 - 2014-05-18 14:54 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-18 14:54 - 2014-05-18 14:54 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-18 14:53 - 2014-05-18 14:53 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-18 14:45 - 2014-05-18 14:45 - 00022792 _____ () C:\Users\Meriem\Desktop\Fragen + Antworten Skript.odt

Some content of TEMP:
====================
C:\Users\Meriem\AppData\Local\Temp\avgnt.exe
C:\Users\Meriem\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Meriem\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Meriem\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Meriem\AppData\Local\Temp\SDShelEx-x64.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-11 18:13

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-06-2014
Ran by Meriem at 2014-06-17 14:43:34
Running from C:\Users\Meriem\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

µTorrent (HKCU\...\uTorrent) (Version: 3.4.1.30768 - BitTorrent Inc.)
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.10.100.30322 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{EB7F3D3C-1729-1743-FE07-6CA87F465500}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2013.0322.413.5642 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80322.0410 - Advanced Micro Devices, Inc.) Hidden
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.4.2.0 - AppEx Networks)
AMD Steady Video Plug-In  (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0322.413.5642 - Ihr Firmenname) Hidden
Avira (HKLM-x32\...\{70a79d1f-686d-4d5c-962b-07aa1294eae0}) (Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0322.0412.5642 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0322.413.5642 - Advanced Micro Devices, Inc.) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Download Protect (HKCU\...\{132401a7-2006-4342-b43c-ccf5f02c2b01}) (Version:  - Download Protect)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.4 - Lenovo)
Energy Management (x32 Version: 7.0.3.4 - Lenovo) Hidden
EnergyCut (HKLM-x32\...\{6E127727-CE4B-40E4-9A7D-9D65CDE0A15C}) (Version: 1.00 - Lenovo)
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10206 - Realtek Semiconductor Corp.)
Lenovo_Wireless_Driver (HKLM-x32\...\{36CE10BD-A076-4DE3-A8A7-2F61E3FB2E6A}) (Version: 6.20.55.14 - Lenovo)
LinuxLive USB Creator (HKLM-x32\...\LinuxLive USB Creator) (Version: 2.8 - Thibaut Lauziere)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
OEM Application Profile (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 6.2.9200.39041 - Realtek Semiconductor Corp.)
Shockwave (HKLM-x32\...\Shockwave) (Version:  - )
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2881065) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B7EF38F7-1D58-4085-A9A4-0F6C69A5AA1E}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
WinRAR 5.10 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.2 - win.rar GmbH)

==================== Restore Points  =========================

28-05-2014 21:34:22 Uniblue SpeedUpMyPC installation
02-06-2014 22:26:31 Windows-Sicherung
09-06-2014 14:58:56 Windows-Sicherung
11-06-2014 01:00:21 Windows Update
13-06-2014 17:41:42 TuneUp Utilities 2014 wird installiert
15-06-2014 17:04:52 Windows-Sicherung
15-06-2014 17:14:51 Windows-Sicherung
16-06-2014 22:24:48 zoek.exe restore point
17-06-2014 11:11:29 TuneUp Utilities 2014 wird entfernt
17-06-2014 11:13:30 TuneUp Utilities 2014 (de-DE) wird entfernt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-06-16 14:48 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {3A7D86A2-2ECC-4BD0-82F2-7256B8383DED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13] (Google Inc.)
Task: {84E252D5-1B05-4A99-ABA5-611C867C51FA} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {8A876ABD-566D-4E33-9726-213253CA4633} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {8DFAA3AC-EC7E-498C-9C17-E0FCFF667C6F} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {9243095E-05F9-4A6D-B970-C7A737FC3735} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2847094928-2611277413-3262722226-1000
Task: {A512DD33-7FBB-46AE-AD56-3474A0AF52D3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {C178AFD6-56F8-4FE9-9D72-FC93189A981B} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-05-08] (Adobe Systems Incorporated)
Task: {FC0E6EA0-3FCC-4E72-A8B1-EC0CC4C09004} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-13] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-03-22 04:24 - 2013-03-22 04:24 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2008-12-20 03:20 - 2014-04-19 18:41 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-10 16:30 - 2014-04-19 18:41 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2014-04-19 18:41 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2014-04-19 18:40 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2014-06-12 21:59 - 2014-06-12 21:59 - 00119296 _____ () C:\Windows\system32\PerfCfnterCPL.exe
2013-03-22 04:24 - 2013-03-22 04:24 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-06-13 01:28 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-06-13 01:28 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-06-13 01:28 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-06-13 01:28 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-06-13 01:28 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-06-17 00:57 - 2014-05-05 10:37 - 00049744 _____ () C:\Users\Meriem\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-04-21 12:36 - 2005-06-24 19:05 - 00045056 _____ () C:\Program Files (x86)\Lenovo\EnergyCut\HookLib.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00138320 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-06-16 14:51 - 2014-06-16 14:51 - 00012288 _____ () C:\Program Files (x86)\Google\Chrome\Application\WTSAPI32.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-13 18:23 - 2014-06-05 15:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMPCHelper => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tvnserver => ""=""

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: BCM43142A0
Description: BCM43142A0
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/17/2014 02:39:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2014 02:39:32 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/17/2014 00:56:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2014 00:56:28 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/17/2014 00:15:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2014 00:15:13 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/16/2014 11:42:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/16/2014 11:42:00 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (06/16/2014 03:31:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/16/2014 03:30:16 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.


System errors:
=============
Error: (06/17/2014 02:23:18 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.1.100 mit dem Computer mit der
Netzwerkhardwareadresse 00-1B-B1-28-DC-41 ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.

Error: (06/17/2014 00:44:27 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:26 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:25 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:25 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:24 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:24 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:23 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:22 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/17/2014 00:44:22 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-06-16 14:47:36.067
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-06-16 14:47:35.772
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 3529.27 MB
Available physical RAM: 1803.76 MB
Total Pagefile: 7056.72 MB
Available Pagefile: 4900.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:244.83 GB) (Free:178.85 GB) NTFS
Drive e: (Ubuntu 14.04 LTS) (CDROM) (Total:0.94 GB) (Free:0 GB) CDFS
Drive g: (Daten) (Fixed) (Total:220.7 GB) (Free:219.6 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: D9FA2484)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 3 h) dauern.
Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg.






Schritt 1

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 2
Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.






Bitte poste mit deiner nächsten Antwort

• die Logdatei von ESET,
• die Logdatei von SecurityCheck.

eset läuft mittlerweile seit über 11 std,
computer wird geprüft... fortschritt liegt bei 0%, hab ich was falsch gemacht?

 Results of screen317's Security Check version 0.99.83  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Spybot - Search & Destroy 
 Adobe Reader XI  
 Google Chrome 35.0.1916.153  
 Google Chrome wtsapi32.dll..  
````````Process Check: objlist.exe by Laurent````````  
 Spybot Teatimer.exe is disabled! 
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````