Hallo Trojanerboard.
Ihr habt mir schon mal so toll geholfen.
Am 24.10. gegen 21:30 dämlicherweise auf etwas im Internet geklickt. Daraufhin hat sich etwas auf meinem Rechner installiert.
Erscheinungen:
1.Startseite Firefox"mystartsearch.com" nicht in Einstellungen/Suchmaschinenverwaltung entfernbar
2. es öffnet sich in Firefox bei jedem Start ein neuer tab mit "chrome://quick_start/content/index.html" in der Adresszeile

Maßnahmen bisher:
Malware

• bites laufen lassen
• Avira laufen lassen
• Unerwünschtes in Quarantäne gepackt.
• In Windows / System 3 Dateien gelöscht, die am 24.10. kurz nach 21:30 Uhr da drauf gekommen sind und setup, exe und redirect in Name und/oder Dateiendung hatten. Dabei war ein windowsmangerprotect-setup.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:44 on 26/10/2014 (Constanze)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2014
Ran by Constanze (administrator) on WULLI on 26-10-2014 19:46:27
Running from C:\Users\Constanze\Desktop
Loaded Profile: Constanze (Available profiles: UpdatusUser & Constanze)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
() C:\Windows\SysWOW64\srvany.exe
(O2Micro.) C:\Windows\SysWOW64\SDIOAssist.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [DFEPApplication] => C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe [7077432 2012-08-15] (Dell Inc.)
HKLM\...\Run: [TdmNotify] => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe [257392 2011-05-28] (Wave Systems Corp.)
HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [477600 2013-01-24] (Adobe Systems Incorporated)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2041192 2012-10-08] ()
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686744 2012-09-05] ()
HKLM\...\Run: [Onboard] => C:\Program Files\Western Digital\WD SmartWare\WDSmartWare.exe [3164536 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112408 2011-08-09] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [462993 2010-03-12] (Creative Technology Ltd)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Reader Library Launcher] => C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5524336 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (UPEK Inc.)
HKU\S-1-5-21-3530594910-3682233180-4012714100-1001\...\Run: [TornTv Downloader] => C:\Users\Constanze\AppData\Roaming\TornTV.com\Torntv Downloader.exe /c=startup
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: ,C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AkrutoSync.lnk
ShortcutTarget: AkrutoSync.lnk -> C:\Program Files\Akruto\AkrutoSync.exe (Akruto)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
ShellIconOverlayIdentifiers: [EnabledUnlockedFDEIconOverlay] -> {30D3C2AF-9709-4D05-9CF4-13335F3C1E4A} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)
ShellIconOverlayIdentifiers: [UninitializedFdeIconOverlay] -> {CF08DA3E-C97D-4891-A66B-E39B28DD270F} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hp&ts=1414180847&from=ild&uid=ST9250315AS_6VCYRXP4XXXX6VCYRXP4
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hp&ts=1414180847&from=ild&uid=ST9250315AS_6VCYRXP4XXXX6VCYRXP4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1414180847&from=ild&uid=ST9250315AS_6VCYRXP4XXXX6VCYRXP4
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1414180847&from=ild&uid=ST9250315AS_6VCYRXP4XXXX6VCYRXP4&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1414180847&from=ild&uid=ST9250315AS_6VCYRXP4XXXX6VCYRXP4&q={searchTerms}
SearchScopes: HKCU - {A9F37828-A92C-477B-98B6-04329E3B861F} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} ->  No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default
FF NewTab: chrome://quick_start/content/index.html
FF SelectedSearchEngine: mystartsearch
FF Homepage: about:home
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.38 -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @sony.com/eBookLibrary -> C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\avira-safesearch.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\abs@avira.com [2014-09-30]
FF Extension: FoxyProxy Standard - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\foxyproxy@eric.h.jung [2014-09-07]
FF Extension: Avira SafeSearch - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\safesearch@avira.com [2014-09-29]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-09-23]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\extensions\faststartff@gmail.com
FF HKCU\...\Firefox\Extensions: [{8492baab-62ca-4e2c-983b-dfef7cae8082}] - C:\Program Files (x86)\PassShow\154.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.mystartsearch.com/?type=sc&ts=1414180847&from=ild&uid=ST9250315AS_6VCYRXP4XXXX6VCYRXP4

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DFEPService; c:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe [2280504 2012-08-15] (Dell Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 O2SDIOAssist; c:\Windows\SysWOW64\srvany.exe [8192 2003-04-19] () [File not signed]
S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2010-04-02] (Sony Corporation) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S2 tcsd_win32.exe; C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1633280 2011-02-17] () [File not signed]
R2 Wave Authentication Manager Service; C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [1600000 2011-07-01] (Wave Systems Corp.) [File not signed]
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2013-06-19] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [270704 2013-11-20] (Western Digital Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-29] (Avira Operations GmbH & Co. KG)
S3 HBtnKey; C:\Windows\system32\drivers\HBtnKey.sys [20424 2011-07-19] (Dell Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-26] (Malwarebytes Corporation)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [61592 2013-12-17] (NetFilterSDK.com)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-03-15] (Oracle Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-26 19:46 - 2014-10-26 19:47 - 00024392 _____ () C:\Users\Constanze\Desktop\FRST.txt
2014-10-26 19:44 - 2014-10-26 19:44 - 00000480 _____ () C:\Users\Constanze\Desktop\defogger_disable.log
2014-10-26 19:31 - 2014-10-26 19:31 - 00380416 _____ () C:\Users\Constanze\Desktop\Gmer-19357.exe
2014-10-26 19:30 - 2014-10-26 19:30 - 02113024 _____ (Farbar) C:\Users\Constanze\Desktop\FRST64.exe
2014-10-26 19:29 - 2014-10-26 19:29 - 00050477 _____ () C:\Users\Constanze\Desktop\Defogger.exe
2014-10-24 22:02 - 2014-10-24 22:02 - 00020802 _____ () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite.xht
2014-10-24 22:02 - 2014-10-24 22:02 - 00000000 ____D () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite-Dateien
2014-10-24 21:07 - 2014-10-24 21:07 - 00000000 ____D () C:\ProgramData\374311380
2014-10-24 21:02 - 2014-10-24 21:02 - 00000000 ____D () C:\Users\Constanze\Documents\Optimizer Pro
2014-10-24 21:02 - 2014-10-24 21:02 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\BandExtend
2014-10-24 21:01 - 2014-10-24 21:51 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-10-24 15:41 - 2014-10-24 16:16 - 00015135 _____ () C:\Users\Constanze\Desktop\Ruggl_schlüssel.xlsx
2014-10-24 14:48 - 2014-10-24 14:48 - 00000000 ____D () C:\Users\Constanze\Downloads\Archiv
2014-10-24 14:45 - 2014-10-24 14:47 - 01123346 _____ () C:\Users\Constanze\Downloads\WordCreatorWin.zip
2014-10-24 00:35 - 2014-10-24 00:35 - 00002089 _____ () C:\Users\Constanze\Desktop\new  1.txt
2014-10-23 20:45 - 2014-10-23 20:45 - 00001099 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Content Viewer.lnk
2014-10-23 20:33 - 2014-10-23 20:33 - 00005632 _____ () C:\Users\Constanze\Documents\Dokument4.zdl
2014-10-23 20:33 - 2014-10-23 20:33 - 00005120 _____ () C:\Users\Constanze\Documents\Dokument3.zdl
2014-10-16 07:05 - 2014-10-16 07:05 - 00000000 ____D () C:\Windows\{B7231620-E76C-4C8E-ADD5-594B1C9FF72F}
2014-10-16 06:38 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 06:38 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 06:38 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 06:38 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 06:38 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 06:38 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 06:38 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 06:38 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 06:38 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 06:38 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 06:38 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 06:38 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 06:38 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 06:38 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 06:38 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 06:38 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 06:38 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 06:38 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 06:38 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 06:38 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 06:38 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 06:38 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 06:38 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 06:38 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 06:38 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 06:38 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 06:38 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 06:37 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 06:37 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 06:37 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 06:37 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 06:37 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 06:36 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 06:36 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-05 21:41 - 2014-10-05 21:41 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Fenomen Games
2014-10-05 21:39 - 2014-10-05 21:40 - 00002299 _____ () C:\Users\Constanze\Desktop\Lost Souls - Timeless Fables.lnk
2014-10-04 22:55 - 2014-10-04 22:55 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Urchin
2014-09-30 20:13 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 20:13 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-26 19:46 - 2014-02-25 09:40 - 00000000 ____D () C:\FRST
2014-10-26 19:45 - 2014-08-23 11:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-26 19:21 - 2012-04-26 19:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-26 19:05 - 2014-07-13 16:43 - 00009331 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML
2014-10-26 18:57 - 2014-06-19 16:09 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Akruto
2014-10-26 18:51 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-26 18:51 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-26 18:48 - 2010-11-21 07:50 - 07936896 _____ () C:\Windows\system32\perfh007.dat
2014-10-26 18:48 - 2010-11-21 07:50 - 02470820 _____ () C:\Windows\system32\perfc007.dat
2014-10-26 18:48 - 2009-07-14 06:13 - 00006512 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-26 18:47 - 2012-01-17 13:24 - 01667752 _____ () C:\Windows\WindowsUpdate.log
2014-10-26 18:44 - 2014-09-12 01:19 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2014-10-26 18:44 - 2012-01-17 13:24 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-26 18:44 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-26 18:44 - 2009-07-14 05:51 - 00182738 _____ () C:\Windows\setupact.log
2014-10-26 18:42 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Abos Vereine
2014-10-26 18:41 - 2012-06-27 18:02 - 00000682 _____ () C:\Windows\BRCALIB.INI
2014-10-26 18:35 - 2014-08-18 19:06 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Adobe
2014-10-26 18:28 - 2012-03-28 16:13 - 00000000 ____D () C:\Users\Constanze\Documents\Briefe diverse Empfänger
2014-10-24 21:21 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-10-24 21:21 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\system32\NV
2014-10-24 21:20 - 2010-11-21 04:47 - 00430052 _____ () C:\Windows\PFRO.log
2014-10-24 21:03 - 2012-03-28 17:43 - 00000000 ____D () C:\Users\Constanze\Documents\Outlook-Dateien
2014-10-24 21:00 - 2014-03-05 19:29 - 00001361 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-24 21:00 - 2012-05-02 20:48 - 00001611 _____ () C:\Users\Constanze\Desktop\Internet Explorer.lnk
2014-10-24 21:00 - 2012-01-24 21:42 - 00001635 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-24 14:49 - 2014-07-14 19:53 - 02959872 _____ () C:\Users\Constanze\Downloads\WordCreator.exe
2014-10-23 20:45 - 2012-01-17 21:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-10-23 20:44 - 2012-09-23 19:23 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2013-04-16 20:49 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-22 20:58 - 2014-06-28 12:31 - 00000000 ____D () C:\Windows\rescache
2014-10-19 18:32 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-19 18:31 - 2009-07-14 05:45 - 05048656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-19 18:27 - 2014-05-07 23:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 07:30 - 2012-01-24 21:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 07:26 - 2013-08-14 21:44 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 07:16 - 2012-03-29 19:44 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-16 07:05 - 2012-01-24 21:43 - 00000000 ____D () C:\Windows\System32\Tasks\Dell
2014-10-16 07:05 - 2012-01-24 21:42 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Dell
2014-10-16 07:05 - 2012-01-17 20:59 - 00000000 ____D () C:\ProgramData\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\Program Files (x86)\Dell
2014-10-16 06:28 - 2012-04-26 19:22 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 06:28 - 2012-01-17 20:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 07:51 - 2014-08-14 19:41 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-15 07:51 - 2013-10-16 20:37 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-15 07:49 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Adressen
2014-10-14 20:01 - 2013-05-07 18:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-12 22:28 - 2013-03-10 21:42 - 00000000 ____D () C:\Users\Constanze\Documents\Calibre Bibliothek
2014-10-12 22:17 - 2012-07-14 21:53 - 00000000 ____D () C:\Users\Constanze\Documents\ePub DRM Removal
2014-10-12 21:54 - 2012-01-17 21:07 - 00000000 ____D () C:\ProgramData\Temp
2014-10-06 23:00 - 2013-03-10 21:42 - 00000932 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\Program Files\Calibre2
2014-10-06 22:54 - 2014-01-25 21:28 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Iplay
2014-10-05 21:38 - 2014-01-25 21:28 - 00000000 ____D () C:\Program Files (x86)\Oberon Media SIDR
2014-10-05 20:15 - 2012-09-23 20:06 - 00001456 _____ () C:\Users\Constanze\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-10-02 14:53 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-01 10:11 - 2014-08-23 11:03 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-01 10:11 - 2014-02-26 18:29 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-01 10:11 - 2013-02-25 20:36 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-29 18:46 - 2012-03-28 16:13 - 00000000 ____D () C:\Users\Constanze\Documents\Briefe_Briefpapier
2014-09-28 21:06 - 2014-08-21 20:05 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Dream Aquarium
2014-09-26 09:53 - 2014-03-05 19:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Constanze\AppData\Local\Temp\1xt0f5po.jrz.exe
C:\Users\Constanze\AppData\Local\Temp\avgnt.exe
C:\Users\Constanze\AppData\Local\Temp\heg3os5n.xrz.exe
C:\Users\Constanze\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Constanze\AppData\Local\Temp\optprosetup.exe
C:\Users\Constanze\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Constanze\AppData\Local\Temp\sdapskill.exe
C:\Users\Constanze\AppData\Local\Temp\sdaspwn.exe
C:\Users\Constanze\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\Users\Constanze\AppData\Local\Temp\WEB.DE_MailCheck_FF_Setup_2.10.1.1735.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-22 20:51

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2014
Ran by Constanze at 2014-10-26 19:47:56
Running from C:\Users\Constanze\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.10.34 - STMicroelectronics)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.8 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Design Standard (HKLM-x32\...\{0327A4BF-62BF-48BB-8928-B971B749E9E1}) (Version: 6 - Adobe Systems Incorporated)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.4.3 - Adobe Systems, Incorporated)
AkrutoSync 3.2.32 (HKLM\...\{024E90DA-8432-40E9-8B31-3C68D1999A36}) (Version: 3.2.32 - Akruto, Inc.)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
BioAPI Framework (Version: 1.0.2 - Dell Inc.) Hidden
Brother MFL-Pro Suite DCP-9055CDN (HKLM-x32\...\{979742CC-2CBB-49D8-9BEE-C2F7875F5393}) (Version: 1.0.27.0 - Brother Industries, Ltd.)
calibre 64bit (HKLM\...\{7A073C16-B3B5-4913-8457-262B6E17947A}) (Version: 2.5.0 - Kovid Goyal)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.3868 - CDBurnerXP)
Classic Adventures 4-in-1 Bundle (HKLM-x32\...\510007534) (Version:  - Oberon Media)
CNM Codec (HKLM-x32\...\{9725A44A-FBBE-427B-8053-1D5ADD0A85E6}) (Version: 1.00.0000 - C & M International)
Criminal Minds (HKLM-x32\...\510006264) (Version:  - Oberon Media)
Custom (Version: 01.00.00.000 - Wave Systems Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery Manager (HKLM\...\{50B4B603-A4C6-4739-AE96-6C76A0F8A388}) (Version: 1.3.1 - Dell Inc.)
Dell Command | Update (HKLM-x32\...\{EC542D5D-B608-4145-A8F7-749C02BE6D94}) (Version: 2.0.0 - Dell Inc.)
Dell ControlVault Host Components Installer 64 bit (Version: 2.1.6.214 - Broadcom Corporation) Hidden
Dell Data Protection | Access (HKLM-x32\...\{A7D91856-258D-4C87-8041-B170851CE432}) (Version: 2.1.00001.002 - Dell Inc.)
Dell Data Protection | Access (Version: 02.01.01.002 - Wave Systems Corp) Hidden
Dell Data Protection | Access | Drivers (HKLM-x32\...\{4E4E65EE-C456-45AC-B5AD-C62C3A325BD0}) (Version: 2.01.018 - Dell Inc.)
Dell Data Protection | Access | Middleware (HKLM-x32\...\{841CBDD5-4BB5-403E-AEE3-2FADC3890BE8}) (Version: 2.01.010 - Dell Inc.)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Feature Enhancement Pack (HKLM\...\{992D1CE7-A20F-4AB0-9D9D-AFC3418844DA}) (Version: 2.2.1 - Dell)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.134 - ALPS ELECTRIC CO., LTD.)
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.28 - Creative Technology Ltd)
DellAccess (Version: 01.01.00.072 - Wave Systems Corp.) Hidden
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\{D2B31FE6-127F-4E79-8186-F080A282FBC7}) (Version: 1.0.0.46 - Intenium GmbH)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
Dream Aquarium (HKLM-x32\...\DreamAqua) (Version:  - )
Dream Day Wedding Collector Set (HKLM-x32\...\119498770) (Version:  - Oberon Media)
Duden-Bibliothek (HKLM-x32\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.1.0 - Bibliographisches Institut GmbH)
EMBASSY Security Center (Version: 04.03.00.121 - Wave Systems Corp.) Hidden
ePub DRM Removal (HKLM-x32\...\ePubDRMRemoval) (Version: 1.4.1 - eBook Converter)
Free M4a to MP3 Converter 7.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free Studio version 5.9.0.1212 (HKLM-x32\...\Free Studio_is1) (Version: 5.9.0.1212 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.43.806 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.43.806 - DVDVideoSoft Ltd.)
GameCatalog21.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
GameCatalog32.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
Gemalto (Version: 01.64.01.0010 - Wave Systems Corp) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
High-Logic FontCreator 6.5 (HKLM-x32\...\FontCreator6_is1) (Version:  - High-Logic B.V.)
Incredible Worlds Double Pack (HKLM-x32\...\510009534) (Version:  - Oberon Media)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.27.0 (HKLM-x32\...\{F109D156-577D-101B-A622-CF4351943AA4}) (Version: 1.2.27.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections 16.5.2.0 (HKLM\...\PROSetDX) (Version: 16.5.2.0 - Dell)
Intel(R) Network Connections 16.5.2.0 (Version: 16.5.2.0 - Dell) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3040 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kindle DRM Removal (HKLM-x32\...\KindleDRMRemoval) (Version: 1.4.1 - eBook Converter)
Lost Souls - Timeless Fables (HKLM-x32\...\510009657) (Version:  - Oberon Media)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.2 - Notepad++ Team)
NTRU TCG Software Stack (Version: 2.1.36 - Security Innovation, Inc.) Hidden
NVIDIA 3D Vision Treiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 306.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
NVIDIA nView 136.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 136.53 - NVIDIA Corporation)
NVIDIA nView Desktop Manager (Version: 6.14.10.13585 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.0697 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
O2Micro Flash Memory Card Windows Driver (HKLM-x32\...\InstallShield_{0CB3B7EE-52C7-4136-AF40-605567D90318}) (Version: 3.0.07.23 - O2Micro International LTD.)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.0.07.23 - O2Micro International LTD.) Hidden
Oracle VM VirtualBox 4.2.10 (HKLM\...\{E28F112D-4784-4466-AE4B-07B3630C857F}) (Version: 4.2.10 - Oracle Corporation)
PC-CCID (Version: 2.0.0 - Gemalto) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Preboot Manager (Version: 03.03.00.074 - Wave Systems Corp.) Hidden
Private Information Manager (Version: 07.01.00.022 - Wave Systems Corp.) Hidden
Product Key Explorer 3.1.3 (HKLM-x32\...\Product Key Explorer_is1) (Version:  - Nsasoft, LLC.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Reader Library by Sony (HKLM-x32\...\{B70E5793-F912-4C62-AFE2-C4F0B078FD31}) (Version: 3.3.00.07130 - Sony)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SPBA 5.9 (Version: 5.9.4.6686 - UPEK Inc.) Hidden
Tales of Monkey Island (HKLM-x32\...\Tales of Monkey Island) (Version: 3.0.0.0 - Daedalic Entertainment)
Trusted Drive Manager (Version: 4.1.1.312 - Wave Systems Corp.) Hidden
Upek Touchchip Fingerprint Reader (Version: 1.2.004 - Dell Inc.) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wave Infrastructure Installer (Version: 07.67.17.0010 - Wave Systems Corp) Hidden
Wave Support Software Installer (Version: 05.13.00.033 - Wave Systems Corp) Hidden
WD Drive Utilities (HKLM-x32\...\{2D2BD030-2DC0-478F-9710-3554FFC0D797}) (Version: 1.0.7.3 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{B7063C41-A5D1-482D-BE07-34750B26950B}) (Version: 2.1.0.11 - Western Digital Technologies, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Mobile Device Updater Component (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (HKLM\...\9512AA21B791B05A54E27065C45BBC417AB282DF) (Version: 09/11/2009 1.0.1.6 - Dell Inc.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

15-10-2014 17:57:23 Geplanter Prüfpunkt
16-10-2014 05:26:47 Windows Update
16-10-2014 05:39:58 Dell Updates
16-10-2014 06:16:05 Windows Update
19-10-2014 18:30:14 Windows Update
24-10-2014 19:43:35 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-12-11 11:45 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0D5B5C33-BF55-4405-AF6B-9B9B2F96FFDF} - System32\Tasks\Dell\Command Update => C:\Program Files (x86)\Dell\CommandUpdate\DellCommandUpdate.exe [2014-05-05] (Dell Inc.)
Task: {114FC741-9B27-47C3-9ED2-47F49B05D0E7} - System32\Tasks\{663BB892-4617-4AAA-80FF-9CE6AB2EF84B} => D:\SETUP.EXE
Task: {2FD75222-E974-4306-8E45-4A2C0FB8739B} - \Express FilesUpdate No Task File <==== ATTENTION
Task: {3B3F041A-FBAD-4FA5-8E80-3058867E388F} - System32\Tasks\{A7811205-CFFE-4128-A888-06213E056FA9} => D:\SETUP.EXE
Task: {43C15320-82CE-4EE8-8D1E-85A4A0A895C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-16] (Adobe Systems Incorporated)
Task: {4BF51701-F960-4733-A460-5D59D7D1BF60} - System32\Tasks\{4FCB3C49-EC9A-42AE-955A-2660C771F716} => D:\SETUP.EXE
Task: {6DA8F52E-B150-4485-AC34-0EFF1ACD2EF9} - System32\Tasks\{47ED87FF-0DE0-4BF6-AA69-E0A9DA1F22B5} => D:\SETUP.EXE
Task: {70D7B408-C8CE-4C44-B35F-322796755FC5} - System32\Tasks\Western Digital\SmartWare\____Volume_c2befd37_4105_11e1_814f_806e6f6e6963______Volume_03d5da04_e37b_11e3_9737_806e6f6e6963__ => C:\Program Files (x86)\Western Digital\WD SmartWare\BackupTask.exe [2013-06-19] (Western Digital Technologies, Inc.)
Task: {763CD2A9-4CE9-4F8A-85D2-B22F4162EDF3} - System32\Tasks\{4C263F9F-6591-4176-A528-7A43E0982B21} => D:\SETUP.EXE
Task: {81D19C03-FD1A-4150-A557-4D27C1A5D378} - System32\Tasks\{940BD94B-3269-4761-A0FB-B983B98A2045} => D:\SETUP.EXE
Task: {8BC414D6-566A-4EC5-9D8E-274581059BB7} - System32\Tasks\{8CB751C0-FFB0-42CC-B28A-30393C059C63} => D:\SETUP.EXE
Task: {912C4EF3-C2DB-4BC2-9DFB-5FC97B89C0F3} - System32\Tasks\{C14A32B9-BA4A-43AD-8B71-AFD967ED9CC1} => D:\SETUP.EXE
Task: {A2AFDEC9-90E8-4A3A-A889-0E27A7D91A1F} - System32\Tasks\{A0D6453B-6605-4745-9EE1-4CC2517D1D74} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {A794C86B-E2FD-4ADD-BAED-77CAE988746C} - System32\Tasks\{40095177-C9DC-4551-8F92-11A2707DB678} => D:\SETUP.EXE
Task: {B0E6EF93-DA75-42E7-88A4-E79A748E04DA} - System32\Tasks\{BEC3D6AC-7C9A-4CE1-AAC3-33E212D75251} => D:\SETUP.EXE
Task: {B4E59951-ED1F-4B92-B88B-561A7D1CEC44} - System32\Tasks\AdobeAAMUpdater-1.0-Wulli-Constanze => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-01-24] (Adobe Systems Incorporated)
Task: {C2F82158-E617-4FC6-B3A3-F1D7426370C6} - System32\Tasks\{F09AB0D1-E6C1-4052-B95C-5BDD54229614} => D:\SETUP.EXE
Task: {C4AFF9BD-4EAE-4AE8-BB63-E5C11B4CB061} - System32\Tasks\{2744E3A0-78AC-4250-BE65-9E60B92308B6} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {CD5DBC02-859F-4C2A-B471-44E6D3FE2319} - System32\Tasks\{66EC3D49-3FAF-4BD7-BFC3-275842B25861} => D:\SETUP.EXE
Task: {CFECC2D4-1AF3-4F3D-9ACA-5CF8CDC3156A} - System32\Tasks\{BE9068AA-3BD0-4090-B0F1-A6DA4ECF6E40} => D:\SETUP.EXE
Task: {D7658736-0F71-4E6F-BB5F-4AC63C1FC9E1} - System32\Tasks\{ABB68144-B87A-424A-9633-21CA29D080D4} => D:\SETUP.EXE
Task: {DE7D347C-6DB5-4C96-84F0-807527BFC0B5} - System32\Tasks\{5AAFE2D1-5A6E-4EE1-B573-B952C3363EBE} => D:\SETUP.EXE
Task: {E9DC5837-283F-4BDD-9E60-4FB5295583B0} - System32\Tasks\{B5382562-EFCB-4992-9715-2AB036EA833F} => D:\SETUP.EXE
Task: {ED9B950E-BF5C-4659-B621-714280868F9B} - System32\Tasks\{FC0195C6-64AF-4E53-99BE-E481706A9022} => D:\SETUP.EXE
Task: {FAC722AA-8578-479E-84DE-EF32AF6F9807} - System32\Tasks\{A56937AB-F66A-469E-A556-B67BD0AE0C15} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-01-03 12:39 - 2012-10-02 20:51 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-01-17 20:53 - 2003-04-19 03:06 - 00008192 ____N () c:\Windows\SysWOW64\srvany.exe
2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2012-01-17 22:07 - 2011-06-10 19:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-01-17 20:51 - 2012-09-05 11:51 - 00686744 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2012-07-01 20:10 - 2010-03-16 00:18 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2012-07-01 20:10 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2010-07-13 00:28 - 2010-07-13 00:28 - 00856064 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\fsk.dll
2010-07-13 00:13 - 2010-07-13 00:13 - 00033792 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMediaPlayers.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00233472 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\Fskin.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00020480 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskinLocalize.dll
2010-04-02 20:23 - 2010-04-02 20:23 - 00815104 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskSecurity.dll
2010-07-13 00:16 - 2010-07-13 00:16 - 00118784 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskDocumentViewer.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00009728 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskPower.dll
2010-07-13 00:26 - 2010-07-13 00:26 - 00018432 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskNetInterface.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00010240 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMobileMediaDevice.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00008704 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00028160 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ticket.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00011776 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll
2010-04-02 19:44 - 2010-04-02 19:44 - 00086016 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookUsb.dll
2010-07-13 00:29 - 2010-07-13 00:29 - 00143360 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\connectionDetector.dll
2010-07-13 00:10 - 2010-07-13 00:10 - 00172032 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\USBDetector.dll
2013-09-03 14:54 - 2013-09-03 14:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\acrotray.deu

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:0EFEBFCB
AlternateDataStreams: C:\ProgramData\Temp:214562D2
AlternateDataStreams: C:\ProgramData\Temp:215C73EE
AlternateDataStreams: C:\ProgramData\Temp:2307DBD5
AlternateDataStreams: C:\ProgramData\Temp:3DBF3B08
AlternateDataStreams: C:\ProgramData\Temp:49B71832
AlternateDataStreams: C:\ProgramData\Temp:6126E9A8
AlternateDataStreams: C:\ProgramData\Temp:C91E924C
AlternateDataStreams: C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

========================= Accounts: ==========================

Administrator (S-1-5-21-3530594910-3682233180-4012714100-500 - Administrator - Disabled)
Constanze (S-1-5-21-3530594910-3682233180-4012714100-1001 - Administrator - Enabled) => C:\Users\Constanze
Gast (S-1-5-21-3530594910-3682233180-4012714100-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3530594910-3682233180-4012714100-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3530594910-3682233180-4012714100-1000 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/26/2014 06:57:52 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelQosEventCIntelQosEvent//./root/default

Error: (10/26/2014 06:57:52 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelDot1xEventCIntelDot1xEvent//./root/default

Error: (10/26/2014 06:57:52 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelWLANEventCIntelWLANEvent//./root/default

Error: (10/26/2014 06:48:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (10/26/2014 06:48:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/26/2014 06:48:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/26/2014 06:45:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/26/2014 06:29:30 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (10/26/2014 06:29:30 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/26/2014 06:29:30 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (10/26/2014 06:46:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (10/26/2014 06:46:50 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (10/26/2014 06:44:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NTRU TSS v1.2.1.36 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%0

Error: (10/26/2014 06:28:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (10/26/2014 06:28:23 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (10/26/2014 06:26:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Dell Feature Enhancement Pack Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/26/2014 06:25:59 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Dell Feature Enhancement Pack Service erreicht.

Error: (10/26/2014 06:25:13 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NTRU TSS v1.2.1.36 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%0

Error: (10/25/2014 10:06:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (10/25/2014 10:06:25 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).


Microsoft Office Sessions:
=========================
Error: (10/26/2014 06:57:52 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelQosEventCIntelQosEvent//./root/default

Error: (10/26/2014 06:57:52 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelDot1xEventCIntelDot1xEvent//./root/default

Error: (10/26/2014 06:57:52 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelWLANEventCIntelWLANEvent//./root/default

Error: (10/26/2014 06:48:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (10/26/2014 06:48:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/26/2014 06:48:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/26/2014 06:45:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/26/2014 06:29:30 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (10/26/2014 06:29:30 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/26/2014 06:29:30 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


CodeIntegrity Errors:
===================================
  Date: 2012-12-11 11:44:57.909
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-12-11 11:44:57.894
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 33%
Total physical RAM: 8073.02 MB
Available physical RAM: 5394.38 MB
Total Pagefile: 16144.21 MB
Available Pagefile: 13595.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:219.2 GB) (Free:55.7 GB) NTFS
Drive e: (My Book) (Fixed) (Total:1862.98 GB) (Free:1287.15 GB) NTFS
Drive f: (LaCie) (Fixed) (Total:931.51 GB) (Free:578.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 7F8BABDA)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=13.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=219.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: D0C07B02)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: EE0538F2)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-26 20:36:37
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST925031 rev.D005 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\CONSTA~1\AppData\Local\Temp\pxldqpod.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                               fffff80003202000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 574                                                                               fffff8000320202e 17 bytes [2E, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2148] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                 0000000076ea1465 2 bytes [EA, 76]
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2148] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                0000000076ea14bb 2 bytes [EA, 76]
.text     ...                                                                                                                                              * 2
.text     C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69             0000000076ea1465 2 bytes [EA, 76]
.text     C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            0000000076ea14bb 2 bytes [EA, 76]
.text     ...                                                                                                                                              * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69     0000000076ea1465 2 bytes [EA, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155    0000000076ea14bb 2 bytes [EA, 76]
.text     ...                                                                                                                                              * 2
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW       000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx       00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation       00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW         00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW            0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW          0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW              0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                 0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList         000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo           000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[732] C:\Windows\syswow64\ole32.dll!CoCreateInstance                 0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[3728] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                              0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[3728] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                     000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[3728] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                     00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[3728] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                     00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[3728] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                       00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                     0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW            000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx            00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation            00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW              00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                 0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW               0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                   0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                      0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList              000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                     0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe[4288] C:\Windows\syswow64\ole32.dll!CoCreateInstance                      0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                       000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                       00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                       00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                         00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                            0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                          0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                              0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                 0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                         000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                           000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\QuickTime\QTTask.exe[4316] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                 0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                       0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                              000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                              00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                              00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                   0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                 0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                     0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                        0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                  000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                       0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[4368] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                        0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\kernel32.dll!RegSetValueExA           0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW  000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx  00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation  00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW    00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW       0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW     0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW         0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary            0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList    000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo      000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket           0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[4384] C:\Windows\syswow64\ole32.dll!CoCreateInstance            0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                             0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                    000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                    00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                    00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                      00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                         0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                       0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                           0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                              0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                      000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                        000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                             0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\ole32.dll!CoCreateInstance                              0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                     0000000076ea1465 2 bytes [EA, 76]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                    0000000076ea14bb 2 bytes [EA, 76]
.text     ...                                                                                                                                              * 2
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                             0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                    000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                    00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                    00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                      00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                         0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                       0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                           0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                              0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                      000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                        000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                             0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4512] C:\Windows\syswow64\ole32.dll!CoCreateInstance                              0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                        0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW               000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx               00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation               00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                 00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                    0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                  0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                      0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                         0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                 000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                   000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                        0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\ole32.dll!CoCreateInstance                         0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                0000000076ea1465 2 bytes [EA, 76]
.text     C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155               0000000076ea14bb 2 bytes [EA, 76]
.text     ...                                                                                                                                              * 2
.text     C:\Program Files (x86)\Browny02\BrYNSvc.exe[4688] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        0000000076ea1465 2 bytes [EA, 76]
.text     C:\Program Files (x86)\Browny02\BrYNSvc.exe[4688] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       0000000076ea14bb 2 bytes [EA, 76]
.text     ...                                                                                                                                              * 2
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4716] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                 0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4716] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                        000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4716] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                        00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4716] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                        00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4716] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                          00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                  0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                         000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                         00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                         00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                           00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                              0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                            0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                   0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                           000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                             000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                          0000000076ea1465 2 bytes [EA, 76]
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                         0000000076ea14bb 2 bytes [EA, 76]
.text     ...                                                                                                                                              * 2
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                  0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[5188] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                   0000000075539d0b 5 bytes JMP 0000000164e8122b
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  0000000075761409 7 bytes JMP 0000000164e8128f
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                         000000007577b21b 5 bytes JMP 0000000164e8159b
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                         00000000757f8e24 7 bytes JMP 0000000164e81339
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                         00000000757f8ea9 5 bytes JMP 0000000164e816b8
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                           00000000757f91ff 5 bytes JMP 0000000164e8101e
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              0000000077431d29 5 bytes JMP 0000000164e811d1
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            0000000077431dd7 5 bytes JMP 0000000164e81019
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                0000000077432ab1 5 bytes JMP 0000000164e8154b
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                   0000000077432d17 5 bytes JMP 0000000164e81276
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                           000000007659e96b 5 bytes JMP 0000000164e815b4
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                             000000007659eba5 5 bytes JMP 0000000164e8119a
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                  0000000075505ea5 5 bytes JMP 0000000164e815e6
.text     C:\Users\Constanze\Desktop\Gmer-19357.exe[5972] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                   0000000075539d0b 5 bytes JMP 0000000164e8122b

---- EOF - GMER 2.1 ----
         

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Freitag, 24. Oktober 2014  22:04


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira Antivirus Free
Seriennummer   : 0000149996-AVHOE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : WULLI

Versionsinformationen:
BUILD.DAT      : 14.0.7.306     92015 Bytes  24.09.2014 12:44:00
AVSCAN.EXE     : 14.0.7.266   1014576 Bytes  14.10.2014 19:01:13
AVSCANRC.DLL   : 14.0.7.220     65272 Bytes  14.10.2014 19:01:13
LUKE.DLL       : 14.0.7.220     59696 Bytes  14.10.2014 19:01:28
AVSCPLR.DLL    : 14.0.7.266     94512 Bytes  14.10.2014 19:01:13
REPAIR.DLL     : 14.0.7.266    366328 Bytes  14.10.2014 19:01:12
REPAIR.RDF     : 1.0.2.30      596694 Bytes  24.10.2014 13:40:15
AVREG.DLL      : 14.0.7.220    264952 Bytes  14.10.2014 19:01:12
AVLODE.DLL     : 14.0.7.266    563448 Bytes  14.10.2014 19:01:12
AVLODE.RDF     : 14.0.4.46      64835 Bytes  08.09.2014 17:48:07
XBV00011.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00012.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00013.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00014.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00015.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00016.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00017.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00018.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00019.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00020.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00021.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00022.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00023.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00024.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00025.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00026.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00027.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00028.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00029.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00030.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00031.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00032.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00033.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00034.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00035.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00036.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00037.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00038.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00039.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:31
XBV00040.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:32
XBV00041.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:48:32
XBV00137.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00138.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00139.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00140.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00141.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00142.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00143.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00144.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00145.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00146.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00147.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00148.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00149.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:35
XBV00150.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00151.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00152.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00153.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00154.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00155.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00156.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00157.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00158.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00159.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00160.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00161.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00162.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00163.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00164.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00165.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00166.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00167.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00168.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00169.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00170.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00171.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00172.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00173.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00174.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00175.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00176.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00177.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00178.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00179.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00180.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00181.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00182.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00183.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00184.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00185.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00186.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00187.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00188.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00189.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:36
XBV00190.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00191.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00192.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00193.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00194.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00195.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00196.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00197.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00198.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00199.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00200.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00201.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00202.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00203.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00204.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00205.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00206.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00207.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00208.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00209.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00210.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00211.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00212.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00213.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00214.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00215.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00216.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00217.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00218.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00219.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00220.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00221.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00222.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00223.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00224.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00225.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00226.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:37
XBV00227.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00228.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00229.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00230.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00231.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00232.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00233.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00234.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00235.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00236.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00237.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00238.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00239.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00240.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00241.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00242.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00243.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00244.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00245.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00246.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00247.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00248.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00249.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00250.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00251.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00252.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00253.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00254.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00255.VDF   : 8.11.178.32     2048 Bytes  14.10.2014 19:01:38
XBV00000.VDF   : 7.11.70.0   66736640 Bytes  04.04.2013 18:19:12
XBV00001.VDF   : 7.11.74.226  2201600 Bytes  30.04.2013 08:02:38
XBV00002.VDF   : 7.11.80.60   2751488 Bytes  28.05.2013 07:29:13
XBV00003.VDF   : 7.11.85.214  2162688 Bytes  21.06.2013 14:45:23
XBV00004.VDF   : 7.11.91.176  3903488 Bytes  23.07.2013 08:47:01
XBV00005.VDF   : 7.11.98.186  6822912 Bytes  29.08.2013 14:05:17
XBV00006.VDF   : 7.11.139.38 15708672 Bytes  27.03.2014 18:47:34
XBV00007.VDF   : 7.11.152.100  4193792 Bytes  02.06.2014 17:09:01
XBV00008.VDF   : 8.11.165.192  4251136 Bytes  07.08.2014 15:48:31
XBV00009.VDF   : 8.11.172.30  2094080 Bytes  15.09.2014 17:18:45
XBV00010.VDF   : 8.11.178.32  1581056 Bytes  14.10.2014 19:01:32
XBV00042.VDF   : 8.11.178.58    29696 Bytes  14.10.2014 19:01:32
XBV00043.VDF   : 8.11.178.60     2048 Bytes  14.10.2014 19:01:32
XBV00044.VDF   : 8.11.178.86    21504 Bytes  14.10.2014 06:50:07
XBV00045.VDF   : 8.11.178.88    11776 Bytes  15.10.2014 06:50:07
XBV00046.VDF   : 8.11.178.92    17408 Bytes  15.10.2014 06:50:07
XBV00047.VDF   : 8.11.178.94     2048 Bytes  15.10.2014 06:50:07
XBV00048.VDF   : 8.11.178.116     7680 Bytes  15.10.2014 16:46:30
XBV00049.VDF   : 8.11.178.136    21504 Bytes  15.10.2014 16:46:30
XBV00050.VDF   : 8.11.178.140     2048 Bytes  15.10.2014 16:46:30
XBV00051.VDF   : 8.11.178.162    32768 Bytes  15.10.2014 16:46:30
XBV00052.VDF   : 8.11.178.164     2048 Bytes  15.10.2014 16:46:31
XBV00053.VDF   : 8.11.178.166    14336 Bytes  15.10.2014 05:26:56
XBV00054.VDF   : 8.11.178.170    12800 Bytes  15.10.2014 05:26:56
XBV00055.VDF   : 8.11.178.190     4608 Bytes  15.10.2014 05:26:56
XBV00056.VDF   : 8.11.178.210     5120 Bytes  15.10.2014 05:26:56
XBV00057.VDF   : 8.11.178.230    17920 Bytes  16.10.2014 17:41:53
XBV00058.VDF   : 8.11.178.234     8704 Bytes  16.10.2014 17:41:53
XBV00059.VDF   : 8.11.178.236    13312 Bytes  16.10.2014 17:41:53
XBV00060.VDF   : 8.11.178.240    50176 Bytes  16.10.2014 17:41:53
XBV00061.VDF   : 8.11.179.4      2048 Bytes  16.10.2014 17:41:53
XBV00062.VDF   : 8.11.179.6      2048 Bytes  16.10.2014 17:41:53
XBV00063.VDF   : 8.11.179.8      2048 Bytes  16.10.2014 17:41:53
XBV00064.VDF   : 8.11.179.12    27136 Bytes  16.10.2014 17:41:53
XBV00065.VDF   : 8.11.179.18    29696 Bytes  17.10.2014 17:41:53
XBV00066.VDF   : 8.11.179.20     2048 Bytes  17.10.2014 17:41:53
XBV00067.VDF   : 8.11.179.22     8192 Bytes  17.10.2014 17:41:53
XBV00068.VDF   : 8.11.179.44    12800 Bytes  17.10.2014 17:41:53
XBV00069.VDF   : 8.11.179.62     6656 Bytes  17.10.2014 17:41:53
XBV00070.VDF   : 8.11.179.80    10752 Bytes  17.10.2014 17:41:53
XBV00071.VDF   : 8.11.179.82     2048 Bytes  17.10.2014 17:41:53
XBV00072.VDF   : 8.11.179.100     5632 Bytes  17.10.2014 17:41:53
XBV00073.VDF   : 8.11.179.106    22528 Bytes  17.10.2014 17:41:53
XBV00074.VDF   : 8.11.179.108     2560 Bytes  17.10.2014 17:41:53
XBV00075.VDF   : 8.11.179.110     9216 Bytes  17.10.2014 17:41:53
XBV00076.VDF   : 8.11.179.114    18432 Bytes  18.10.2014 17:41:53
XBV00077.VDF   : 8.11.179.116     3072 Bytes  18.10.2014 17:41:53
XBV00078.VDF   : 8.11.179.118    38912 Bytes  18.10.2014 17:41:53
XBV00079.VDF   : 8.11.179.120     2048 Bytes  18.10.2014 17:41:53
XBV00080.VDF   : 8.11.179.122    52224 Bytes  19.10.2014 17:41:53
XBV00081.VDF   : 8.11.179.140     2048 Bytes  19.10.2014 17:41:53
XBV00082.VDF   : 8.11.179.160    25600 Bytes  19.10.2014 17:41:53
XBV00083.VDF   : 8.11.179.162     2048 Bytes  19.10.2014 17:41:53
XBV00084.VDF   : 8.11.179.180    35328 Bytes  20.10.2014 18:23:55
XBV00085.VDF   : 8.11.179.182     2048 Bytes  20.10.2014 18:23:55
XBV00086.VDF   : 8.11.179.184    12800 Bytes  20.10.2014 18:23:55
XBV00087.VDF   : 8.11.179.186     7168 Bytes  20.10.2014 18:23:55
XBV00088.VDF   : 8.11.179.188    23040 Bytes  20.10.2014 18:23:55
XBV00089.VDF   : 8.11.179.190     2048 Bytes  20.10.2014 18:23:55
XBV00090.VDF   : 8.11.179.192     2048 Bytes  20.10.2014 18:23:55
XBV00091.VDF   : 8.11.179.194    13312 Bytes  20.10.2014 18:23:55
XBV00092.VDF   : 8.11.179.196     2048 Bytes  20.10.2014 18:23:55
XBV00093.VDF   : 8.11.179.216    36352 Bytes  20.10.2014 18:23:55
XBV00094.VDF   : 8.11.179.232     2048 Bytes  20.10.2014 18:23:55
XBV00095.VDF   : 8.11.179.234     2048 Bytes  20.10.2014 18:23:55
XBV00096.VDF   : 8.11.180.12    32256 Bytes  21.10.2014 18:23:55
XBV00097.VDF   : 8.11.180.30    17408 Bytes  21.10.2014 18:23:56
XBV00098.VDF   : 8.11.180.32     2048 Bytes  21.10.2014 18:23:56
XBV00099.VDF   : 8.11.180.34    16384 Bytes  21.10.2014 18:23:56
XBV00100.VDF   : 8.11.180.40     8704 Bytes  21.10.2014 18:23:56
XBV00101.VDF   : 8.11.180.42    10240 Bytes  21.10.2014 18:23:56
XBV00102.VDF   : 8.11.180.44    31744 Bytes  21.10.2014 18:23:56
XBV00103.VDF   : 8.11.180.60     2048 Bytes  21.10.2014 18:23:56
XBV00104.VDF   : 8.11.180.64    24576 Bytes  21.10.2014 18:23:56
XBV00105.VDF   : 8.11.180.66     6144 Bytes  21.10.2014 18:23:56
XBV00106.VDF   : 8.11.180.70     2560 Bytes  21.10.2014 18:23:56
XBV00107.VDF   : 8.11.180.88    33280 Bytes  22.10.2014 18:23:56
XBV00108.VDF   : 8.11.180.104     2560 Bytes  22.10.2014 18:23:56
XBV00109.VDF   : 8.11.180.106     2048 Bytes  22.10.2014 18:23:56
XBV00110.VDF   : 8.11.180.122    25600 Bytes  22.10.2014 18:23:56
XBV00111.VDF   : 8.11.180.138    11264 Bytes  22.10.2014 18:23:56
XBV00112.VDF   : 8.11.180.140    20992 Bytes  22.10.2014 18:23:56
XBV00113.VDF   : 8.11.180.142     2048 Bytes  22.10.2014 18:23:56
XBV00114.VDF   : 8.11.180.144     2048 Bytes  22.10.2014 18:23:56
XBV00115.VDF   : 8.11.180.150    43520 Bytes  22.10.2014 18:20:33
XBV00116.VDF   : 8.11.180.154     2048 Bytes  22.10.2014 18:20:33
XBV00117.VDF   : 8.11.180.172    12288 Bytes  22.10.2014 18:20:33
XBV00118.VDF   : 8.11.180.174     2048 Bytes  22.10.2014 18:20:33
XBV00119.VDF   : 8.11.180.188     7168 Bytes  22.10.2014 18:20:33
XBV00120.VDF   : 8.11.180.204    11776 Bytes  23.10.2014 18:20:34
XBV00121.VDF   : 8.11.180.206     3584 Bytes  23.10.2014 18:20:34
XBV00122.VDF   : 8.11.180.208    22016 Bytes  23.10.2014 18:20:34
XBV00123.VDF   : 8.11.180.210    20992 Bytes  23.10.2014 18:20:34
XBV00124.VDF   : 8.11.180.212     2048 Bytes  23.10.2014 18:20:34
XBV00125.VDF   : 8.11.180.214     2560 Bytes  23.10.2014 18:20:34
XBV00126.VDF   : 8.11.180.220    32768 Bytes  23.10.2014 13:40:14
XBV00127.VDF   : 8.11.180.222     2048 Bytes  23.10.2014 13:40:14
XBV00128.VDF   : 8.11.180.224     2048 Bytes  23.10.2014 13:40:14
XBV00129.VDF   : 8.11.180.226    15872 Bytes  23.10.2014 13:40:14
XBV00130.VDF   : 8.11.180.228     2048 Bytes  23.10.2014 13:40:14
XBV00131.VDF   : 8.11.180.232    28672 Bytes  24.10.2014 13:40:14
XBV00132.VDF   : 8.11.180.234     2048 Bytes  24.10.2014 13:40:15
XBV00133.VDF   : 8.11.180.236    38912 Bytes  24.10.2014 13:40:15
XBV00134.VDF   : 8.11.180.250     2048 Bytes  24.10.2014 13:40:15
XBV00135.VDF   : 8.11.180.252     2048 Bytes  24.10.2014 13:40:15
XBV00136.VDF   : 8.11.181.10    14336 Bytes  24.10.2014 19:40:48
LOCAL000.VDF   : 8.11.181.10 112553984 Bytes  24.10.2014 19:41:17
Engineversion  : 8.3.24.40 
AEVDF.DLL      : 8.3.1.6       133992 Bytes  21.08.2014 17:33:31
AESCRIPT.DLL   : 8.2.0.30      437104 Bytes  19.10.2014 17:41:52
AESCN.DLL      : 8.3.2.2       139456 Bytes  21.07.2014 19:05:32
AESBX.DLL      : 8.2.20.24    1409224 Bytes  11.05.2014 14:04:49
AERDL.DLL      : 8.2.0.138     704888 Bytes  03.12.2013 21:27:48
AEPACK.DLL     : 8.4.0.54      788392 Bytes  25.09.2014 17:26:58
AEOFFICE.DLL   : 8.3.0.36      223144 Bytes  23.10.2014 18:20:33
AEHEUR.DLL     : 8.1.4.1356   7682928 Bytes  23.10.2014 18:20:33
AEHELP.DLL     : 8.3.1.0       278728 Bytes  28.05.2014 15:53:48
AEGEN.DLL      : 8.1.7.30      453480 Bytes  26.09.2014 14:59:17
AEEXP.DLL      : 8.4.2.32      247712 Bytes  04.09.2014 17:45:34
AEEMU.DLL      : 8.1.3.4       399264 Bytes  09.08.2014 15:48:26
AEDROID.DLL    : 8.4.2.24      442568 Bytes  04.06.2014 18:11:37
AECORE.DLL     : 8.3.2.6       243712 Bytes  09.08.2014 15:48:26
AEBB.DLL       : 8.1.2.0        60448 Bytes  09.08.2014 15:48:26
AVWINLL.DLL    : 14.0.7.220     25904 Bytes  14.10.2014 19:01:10
AVPREF.DLL     : 14.0.7.220     52016 Bytes  14.10.2014 19:01:12
AVREP.DLL      : 14.0.7.220    220976 Bytes  14.10.2014 19:01:12
AVARKT.DLL     : 14.0.7.220    227632 Bytes  14.10.2014 19:01:10
AVEVTLOG.DLL   : 14.0.7.220    185080 Bytes  14.10.2014 19:01:11
SQLITE3.DLL    : 14.0.7.220    453936 Bytes  14.10.2014 19:01:31
AVSMTP.DLL     : 14.0.7.220     79096 Bytes  14.10.2014 19:01:14
NETNT.DLL      : 14.0.7.220     15152 Bytes  14.10.2014 19:01:28
RCIMAGE.DLL    : 14.0.7.220   4865328 Bytes  14.10.2014 19:01:10
RCTEXT.DLL     : 14.0.7.240     77048 Bytes  14.10.2014 19:01:10

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_544a5595\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: Reparieren
Sekundäre Aktion......................: Quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: Vollständig
Abweichende Gefahrenkategorien........: +PCK,+SPR,

Beginn des Suchlaufs: Freitag, 24. Oktober 2014  22:04

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '100' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '170' Modul(e) wurden durchsucht
Durchsuche Prozess 'STacSV64.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'HostControlService.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'HostStorageService.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'upeksvr.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'TdmService.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'AESTSr64.exe' - '8' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'IProsetMonitor.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'jhi_service.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamscheduler.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'o2flash.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'srvany.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDIOAssist.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'WaveAMService.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDDriveService.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'DFEPService.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDBackupEngine.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '127' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '198' Modul(e) wurden durchsucht
Durchsuche Prozess 'Apoint.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'sttray64.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'DFEPApplication.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'TdmNotify.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'ZuneLauncher.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'FF_Protection.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'ONENOTEM.EXE' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'WebcamDell2.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'SmartSettings.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'QTTask.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrStMonW.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'ICCProxy.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'Reader Library Launcher.exe' - '102' Modul(e) wurden durchsucht
Durchsuche Prozess 'AdobeARM.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'acrotray.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDDMStatus.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '131' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrYNSvc.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'ApMsgFwd.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'HidFind.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'Apntex.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'OSPPSVC.EXE' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'PrivacyIconClient.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'splwow64.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'EXCEL.EXE' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'TornTVSvc.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'ProtectWindowsManager.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'PluginService.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'HpUI.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'Loader64.exe' - '13' Modul(e) wurden durchsucht
Durchsuche Prozess 'Loader32.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\drivers\beep.sys'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Signiert -> 'C:\Windows\system32\imm32.dll'
Signiert -> 'C:\Windows\system32\dsound.dll'
Signiert -> 'C:\Windows\system32\aclui.dll'
Signiert -> 'C:\Windows\system32\msvcrt.dll'
Signiert -> 'C:\Windows\system32\d3d9.dll'
Signiert -> 'C:\Windows\system32\dnsapi.dll'
Signiert -> 'C:\Windows\system32\mshtml.dll'
Signiert -> 'C:\Windows\system32\regsvr32.exe'
Signiert -> 'C:\Windows\system32\rundll32.exe'
Signiert -> 'C:\Windows\system32\userinit.exe'
Signiert -> 'C:\Windows\system32\reg.exe'
Signiert -> 'C:\Windows\regedit.exe'
Die Systemdateien wurden durchsucht ('34' Dateien)

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll'
[ERROR] RepairMalware: Not able to Repair Malware APPL/SubTab.spe
[INFO] RepairMalware: Disinfection of malware APPL/SubTab.spe needs a reboot to complete
[INFO] RepairMalware: Disinfection of malware APPL/SubTab.spe needs a reboot to complete
C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll (SHA-256: f67aa8c66d98571cda0911b1aba449ecf0d78ea84d142a3a0a92f55ded8cad61)
  [FUND]      Enthält Erkennungsmuster der Anwendung APPL/SubTab.spe (Cloud)
  [WARNUNG]   Beim Versuch eine Sicherungskopie der Datei anzulegen ist ein Fehler aufgetreten und die Datei wurde nicht gelöscht. Fehlernummer: 26003
  [WARNUNG]   Die Datei konnte nicht gelöscht werden!
  [HINWEIS]   Es wird versucht die Aktion mit Hilfe der ARK Library durchzuführen.
  [WARNUNG]   Die Datei konnte nicht ins Quarantäneverzeichnis verschoben werden!
  [WARNUNG]   Die Datei konnte nicht gelöscht werden!


Ende des Suchlaufs: Freitag, 24. Oktober 2014  22:07
Benötigte Zeit: 02:56 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      0 Verzeichnisse wurden überprüft
   1104 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
   1103 Dateien ohne Befall
      4 Archive wurden durchsucht
      1 Warnungen
      1 Hinweise
         

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 24.10.2014
Suchlauf-Zeit: 21:29:50
Logdatei: mbam-log_2014-10-24_21-29.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.10.24.07
Rootkit Datenbank: v2014.10.22.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Constanze

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 417533
Verstrichene Zeit: 28 Min, 59 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

hi,

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hi schrauber,

# AdwCleaner v4.002 - Bericht erstellt am 27/10/2014 um 19:27:04
# DB v2014-10-26.6
# Aktualisiert 27/10/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Constanze - WULLI
# Gestartet von : C:\Users\Constanze\Desktop\AdwCleaner_4.002.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : netfilter64

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\374311380 
Ordner Gelöscht : C:\Program Files (x86)\GamesBar
Ordner Gelöscht : C:\Windows\Installer\{6DDE8071-E4BA-461B-8A96-990DFAA0EBD1}
Ordner Gelöscht : C:\Windows\Installer\{813BA625-B0FA-48D8-9B75-59759C88C219}
Ordner Gelöscht : C:\Users\CONSTA~1\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Constanze\Documents\Optimizer Pro
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Datei Gelöscht : C:\Windows\System32\drivers\netfilter64.sys
Datei Gelöscht : C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\11-suche.xml

***** [ Tasks ] *****

Task Gelöscht : Express FilesUpdate

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Constanze\Desktop\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Constanze\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Constanze\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [faststartff@gmail.com]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{8492baab-62ca-4e2c-983b-dfef7cae8082}]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Torntv Downloader]
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\SupHpUISoft
Schlüssel Gelöscht : HKCU\Software\TornTv Downloader
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\1708EDD6AB4EB164A86999D0AF0ABE1D
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\526AB318AF0B8D84B9579557C9882C91
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1708EDD6AB4EB164A86999D0AF0ABE1D
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\526AB318AF0B8D84B9579557C9882C91

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17344

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]

-\\ Mozilla Firefox v32.0.3 (x86 de)


*************************

AdwCleaner[R0].txt - [3368 octets] - [27/02/2014 18:24:48]
AdwCleaner[R1].txt - [4991 octets] - [27/10/2014 19:22:26]
AdwCleaner[S0].txt - [3336 octets] - [27/02/2014 18:28:30]
AdwCleaner[S1].txt - [4755 octets] - [27/10/2014 19:27:04]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [4815 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 7 Professional x64
Ran by Constanze on 27.10.2014 at 21:04:58,80
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\Users\Constanze\AppData\Roaming\mozilla\firefox\profiles\8rw89n0f.default\searchplugins\avira-safesearch.xml
Successfully deleted: [Folder] C:\Users\Constanze\AppData\Roaming\mozilla\firefox\profiles\8rw89n0f.default\extensions\safesearch@avira.com
Successfully deleted the following from C:\Users\Constanze\AppData\Roaming\mozilla\firefox\profiles\8rw89n0f.default\prefs.js

user_pref("avira.safe_search.search_was_active", "false");
user_pref("browser.search.selectedEngine", "mystartsearch");
user_pref("extensions.bootstrappedAddons", "{\"safesearch@avira.com\":{\"version\":\"1.1.0\",\"type\":\"extension\",\"descriptor\":\"C:\\\\Users\\\\Constanze\\\\AppData\\\\Roa
user_pref("extensions.safesearch.MP_DISTINCT_ID", "\"147decbb66d103-047ea442ee1ad58-42504136-0-147decbb66e15d\"");
user_pref("extensions.safesearch.SAUTH_expires_at", "1413997716");
user_pref("extensions.safesearch.SAUTH_rndsnr", "\"1b49f6d8c3b7581e0a5c1c2be3731bc387c0c033\"");
user_pref("extensions.safesearch.SAUTH_userid", "4296390802");
user_pref("extensions.safesearch.SAUTH_utoken", "\"3b06b0668a2ae7047ba2481013d1f91d94fc7af8\"");
user_pref("extensions.safesearch.install", "1408192198258");
Emptied folder: C:\Users\Constanze\AppData\Roaming\mozilla\firefox\profiles\8rw89n0f.default\minidumps [40 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.10.2014 at 21:07:58,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2014
Ran by Constanze (administrator) on WULLI on 27-10-2014 21:14:55
Running from C:\Users\Constanze\Desktop
Loaded Profile: Constanze (Available profiles: UpdatusUser & Constanze)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
() C:\Windows\SysWOW64\srvany.exe
(O2Micro.) C:\Windows\SysWOW64\SDIOAssist.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [DFEPApplication] => C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe [7077432 2012-08-15] (Dell Inc.)
HKLM\...\Run: [TdmNotify] => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe [257392 2011-05-28] (Wave Systems Corp.)
HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [477600 2013-01-24] (Adobe Systems Incorporated)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2041192 2012-10-08] ()
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686744 2012-09-05] ()
HKLM\...\Run: [Onboard] => C:\Program Files\Western Digital\WD SmartWare\WDSmartWare.exe [3164536 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112408 2011-08-09] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [462993 2010-03-12] (Creative Technology Ltd)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Reader Library Launcher] => C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5524336 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (UPEK Inc.)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: ,C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AkrutoSync.lnk
ShortcutTarget: AkrutoSync.lnk -> C:\Program Files\Akruto\AkrutoSync.exe (Akruto)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
ShellIconOverlayIdentifiers: [EnabledUnlockedFDEIconOverlay] -> {30D3C2AF-9709-4D05-9CF4-13335F3C1E4A} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)
ShellIconOverlayIdentifiers: [UninitializedFdeIconOverlay] -> {CF08DA3E-C97D-4891-A66B-E39B28DD270F} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {A9F37828-A92C-477B-98B6-04329E3B861F} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: about:home
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.38 -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @sony.com/eBookLibrary -> C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\abs@avira.com [2014-09-30]
FF Extension: FoxyProxy Standard - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\foxyproxy@eric.h.jung [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-09-23]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DFEPService; c:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe [2280504 2012-08-15] (Dell Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 O2SDIOAssist; c:\Windows\SysWOW64\srvany.exe [8192 2003-04-19] () [File not signed]
S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2010-04-02] (Sony Corporation) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S2 tcsd_win32.exe; C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1633280 2011-02-17] () [File not signed]
R2 Wave Authentication Manager Service; C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [1600000 2011-07-01] (Wave Systems Corp.) [File not signed]
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2013-06-19] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [270704 2013-11-20] (Western Digital Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-29] (Avira Operations GmbH & Co. KG)
S3 HBtnKey; C:\Windows\system32\drivers\HBtnKey.sys [20424 2011-07-19] (Dell Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-26] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-03-15] (Oracle Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-27 21:14 - 2014-10-27 21:15 - 00021667 _____ () C:\Users\Constanze\Desktop\FRST.txt
2014-10-27 21:07 - 2014-10-27 21:14 - 00001982 _____ () C:\Users\Constanze\Desktop\JRT.txt
2014-10-27 20:46 - 2014-10-27 20:46 - 00004911 _____ () C:\Users\Constanze\Desktop\AdwCleaner[S1].txt
2014-10-27 19:19 - 2014-10-27 19:19 - 01706144 _____ (Thisisu) C:\Users\Constanze\Desktop\JRT.exe
2014-10-27 19:18 - 2014-10-27 19:18 - 01998336 _____ () C:\Users\Constanze\Desktop\AdwCleaner_4.002.exe
2014-10-26 21:11 - 2014-10-26 21:43 - 00063316 _____ () C:\Users\Constanze\Desktop\AVSCAN-20141024-220424-4503797A.LOG
2014-10-26 20:36 - 2014-10-26 20:36 - 00032890 _____ () C:\Users\Constanze\Desktop\Gmer.txt
2014-10-26 19:47 - 2014-10-26 19:48 - 00036042 _____ () C:\Users\Constanze\Desktop\Addition26.10.2014.txt
2014-10-26 19:46 - 2014-10-26 19:48 - 00046401 _____ () C:\Users\Constanze\Desktop\FRST26.10.2014.txt
2014-10-26 19:44 - 2014-10-26 19:44 - 00000480 _____ () C:\Users\Constanze\Desktop\defogger_disable.log
2014-10-26 19:31 - 2014-10-26 19:31 - 00380416 _____ () C:\Users\Constanze\Desktop\Gmer-19357.exe
2014-10-26 19:30 - 2014-10-26 19:30 - 02113024 _____ (Farbar) C:\Users\Constanze\Desktop\FRST64.exe
2014-10-26 19:29 - 2014-10-26 19:29 - 00050477 _____ () C:\Users\Constanze\Desktop\Defogger.exe
2014-10-24 22:02 - 2014-10-24 22:02 - 00020802 _____ () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite.xht
2014-10-24 22:02 - 2014-10-24 22:02 - 00000000 ____D () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite-Dateien
2014-10-24 21:02 - 2014-10-24 21:02 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\BandExtend
2014-10-24 15:41 - 2014-10-24 16:16 - 00015135 _____ () C:\Users\Constanze\Desktop\Ruggl_schlüssel.xlsx
2014-10-24 14:48 - 2014-10-24 14:48 - 00000000 ____D () C:\Users\Constanze\Downloads\Archiv
2014-10-24 14:45 - 2014-10-24 14:47 - 01123346 _____ () C:\Users\Constanze\Downloads\WordCreatorWin.zip
2014-10-23 20:45 - 2014-10-23 20:45 - 00001099 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Content Viewer.lnk
2014-10-23 20:33 - 2014-10-23 20:33 - 00005632 _____ () C:\Users\Constanze\Documents\Dokument4.zdl
2014-10-23 20:33 - 2014-10-23 20:33 - 00005120 _____ () C:\Users\Constanze\Documents\Dokument3.zdl
2014-10-16 07:05 - 2014-10-16 07:05 - 00000000 ____D () C:\Windows\{B7231620-E76C-4C8E-ADD5-594B1C9FF72F}
2014-10-16 06:38 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 06:38 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 06:38 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 06:38 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 06:38 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 06:38 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 06:38 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 06:38 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 06:38 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 06:38 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 06:38 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 06:38 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 06:38 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 06:38 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 06:38 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 06:38 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 06:38 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 06:38 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 06:38 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 06:38 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 06:38 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 06:38 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 06:38 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 06:38 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 06:38 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 06:38 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 06:38 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 06:37 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 06:37 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 06:37 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 06:37 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 06:37 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 06:36 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 06:36 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-05 21:41 - 2014-10-05 21:41 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Fenomen Games
2014-10-05 21:39 - 2014-10-05 21:40 - 00002299 _____ () C:\Users\Constanze\Desktop\Lost Souls - Timeless Fables.lnk
2014-10-04 22:55 - 2014-10-04 22:55 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Urchin
2014-09-30 20:13 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 20:13 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-27 21:14 - 2014-02-25 09:40 - 00000000 ____D () C:\FRST
2014-10-27 21:04 - 2012-01-17 13:24 - 01714863 _____ () C:\Windows\WindowsUpdate.log
2014-10-27 21:04 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-27 21:04 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-27 21:00 - 2010-11-21 07:50 - 08041700 _____ () C:\Windows\system32\perfh007.dat
2014-10-27 21:00 - 2010-11-21 07:50 - 02505232 _____ () C:\Windows\system32\perfc007.dat
2014-10-27 21:00 - 2009-07-14 06:13 - 00006512 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-27 20:57 - 2014-09-12 01:19 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2014-10-27 20:57 - 2014-06-19 16:09 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Akruto
2014-10-27 20:56 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-10-27 20:56 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\system32\NV
2014-10-27 20:56 - 2012-01-17 13:24 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-27 20:56 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-27 20:55 - 2009-07-14 05:51 - 00183242 _____ () C:\Windows\setupact.log
2014-10-27 20:21 - 2012-04-26 19:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-27 19:28 - 2010-11-21 04:47 - 00430370 _____ () C:\Windows\PFRO.log
2014-10-27 19:27 - 2014-03-05 19:29 - 00001067 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-27 19:27 - 2014-02-27 18:24 - 00000000 ____D () C:\AdwCleaner
2014-10-27 19:27 - 2012-05-02 20:48 - 00001162 _____ () C:\Users\Constanze\Desktop\Internet Explorer.lnk
2014-10-27 19:27 - 2012-01-24 21:42 - 00001005 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-27 19:07 - 2012-06-27 18:02 - 00000682 _____ () C:\Windows\BRCALIB.INI
2014-10-27 19:06 - 2014-08-18 19:06 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Adobe
2014-10-26 22:56 - 2012-03-28 17:43 - 00000000 ____D () C:\Users\Constanze\Documents\Outlook-Dateien
2014-10-26 22:43 - 2012-01-17 21:07 - 00000000 ____D () C:\ProgramData\Temp
2014-10-26 21:43 - 2014-08-23 11:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-26 19:05 - 2014-07-13 16:43 - 00009331 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML
2014-10-26 18:42 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Abos Vereine
2014-10-26 18:28 - 2012-03-28 16:13 - 00000000 ____D () C:\Users\Constanze\Documents\Briefe diverse Empfänger
2014-10-24 14:49 - 2014-07-14 19:53 - 02959872 _____ () C:\Users\Constanze\Downloads\WordCreator.exe
2014-10-23 20:45 - 2012-01-17 21:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-10-23 20:44 - 2012-09-23 19:23 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2013-04-16 20:49 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-22 20:58 - 2014-06-28 12:31 - 00000000 ____D () C:\Windows\rescache
2014-10-19 18:32 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-19 18:31 - 2009-07-14 05:45 - 05048656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-19 18:27 - 2014-05-07 23:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 07:30 - 2012-01-24 21:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 07:26 - 2013-08-14 21:44 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 07:16 - 2012-03-29 19:44 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-16 07:05 - 2012-01-24 21:43 - 00000000 ____D () C:\Windows\System32\Tasks\Dell
2014-10-16 07:05 - 2012-01-24 21:42 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Dell
2014-10-16 07:05 - 2012-01-17 20:59 - 00000000 ____D () C:\ProgramData\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\Program Files (x86)\Dell
2014-10-16 06:28 - 2012-04-26 19:22 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 06:28 - 2012-01-17 20:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 07:51 - 2014-08-14 19:41 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-15 07:51 - 2013-10-16 20:37 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-15 07:49 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Adressen
2014-10-14 20:01 - 2013-05-07 18:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-12 22:28 - 2013-03-10 21:42 - 00000000 ____D () C:\Users\Constanze\Documents\Calibre Bibliothek
2014-10-12 22:17 - 2012-07-14 21:53 - 00000000 ____D () C:\Users\Constanze\Documents\ePub DRM Removal
2014-10-06 23:00 - 2013-03-10 21:42 - 00000932 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\Program Files\Calibre2
2014-10-06 22:54 - 2014-01-25 21:28 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Iplay
2014-10-05 21:38 - 2014-01-25 21:28 - 00000000 ____D () C:\Program Files (x86)\Oberon Media SIDR
2014-10-05 20:15 - 2012-09-23 20:06 - 00001456 _____ () C:\Users\Constanze\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-10-02 14:53 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-01 10:11 - 2014-08-23 11:03 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-01 10:11 - 2014-02-26 18:29 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-01 10:11 - 2013-02-25 20:36 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-29 18:46 - 2012-03-28 16:13 - 00000000 ____D () C:\Users\Constanze\Documents\Briefe_Briefpapier
2014-09-28 21:06 - 2014-08-21 20:05 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Dream Aquarium

Some content of TEMP:
====================
C:\Users\Constanze\AppData\Local\Temp\1xt0f5po.jrz.exe
C:\Users\Constanze\AppData\Local\Temp\avgnt.exe
C:\Users\Constanze\AppData\Local\Temp\heg3os5n.xrz.exe
C:\Users\Constanze\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Constanze\AppData\Local\Temp\optprosetup.exe
C:\Users\Constanze\AppData\Local\Temp\Quarantine.exe
C:\Users\Constanze\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Constanze\AppData\Local\Temp\sdapskill.exe
C:\Users\Constanze\AppData\Local\Temp\sdaspwn.exe
C:\Users\Constanze\AppData\Local\Temp\sqlite3.dll
C:\Users\Constanze\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\Users\Constanze\AppData\Local\Temp\WEB.DE_MailCheck_FF_Setup_2.10.1.1735.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-27 20:11

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2014
Ran by Constanze at 2014-10-27 21:16:15
Running from C:\Users\Constanze\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.10.34 - STMicroelectronics)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.8 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Design Standard (HKLM-x32\...\{0327A4BF-62BF-48BB-8928-B971B749E9E1}) (Version: 6 - Adobe Systems Incorporated)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.4.3 - Adobe Systems, Incorporated)
AkrutoSync 3.2.32 (HKLM\...\{024E90DA-8432-40E9-8B31-3C68D1999A36}) (Version: 3.2.32 - Akruto, Inc.)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
BioAPI Framework (Version: 1.0.2 - Dell Inc.) Hidden
Brother MFL-Pro Suite DCP-9055CDN (HKLM-x32\...\{979742CC-2CBB-49D8-9BEE-C2F7875F5393}) (Version: 1.0.27.0 - Brother Industries, Ltd.)
calibre 64bit (HKLM\...\{7A073C16-B3B5-4913-8457-262B6E17947A}) (Version: 2.5.0 - Kovid Goyal)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.3868 - CDBurnerXP)
Classic Adventures 4-in-1 Bundle (HKLM-x32\...\510007534) (Version:  - Oberon Media)
CNM Codec (HKLM-x32\...\{9725A44A-FBBE-427B-8053-1D5ADD0A85E6}) (Version: 1.00.0000 - C & M International)
Criminal Minds (HKLM-x32\...\510006264) (Version:  - Oberon Media)
Custom (Version: 01.00.00.000 - Wave Systems Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery Manager (HKLM\...\{50B4B603-A4C6-4739-AE96-6C76A0F8A388}) (Version: 1.3.1 - Dell Inc.)
Dell Command | Update (HKLM-x32\...\{EC542D5D-B608-4145-A8F7-749C02BE6D94}) (Version: 2.0.0 - Dell Inc.)
Dell ControlVault Host Components Installer 64 bit (Version: 2.1.6.214 - Broadcom Corporation) Hidden
Dell Data Protection | Access (HKLM-x32\...\{A7D91856-258D-4C87-8041-B170851CE432}) (Version: 2.1.00001.002 - Dell Inc.)
Dell Data Protection | Access (Version: 02.01.01.002 - Wave Systems Corp) Hidden
Dell Data Protection | Access | Drivers (HKLM-x32\...\{4E4E65EE-C456-45AC-B5AD-C62C3A325BD0}) (Version: 2.01.018 - Dell Inc.)
Dell Data Protection | Access | Middleware (HKLM-x32\...\{841CBDD5-4BB5-403E-AEE3-2FADC3890BE8}) (Version: 2.01.010 - Dell Inc.)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Feature Enhancement Pack (HKLM\...\{992D1CE7-A20F-4AB0-9D9D-AFC3418844DA}) (Version: 2.2.1 - Dell)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.134 - ALPS ELECTRIC CO., LTD.)
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.28 - Creative Technology Ltd)
DellAccess (Version: 01.01.00.072 - Wave Systems Corp.) Hidden
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\{D2B31FE6-127F-4E79-8186-F080A282FBC7}) (Version: 1.0.0.46 - Intenium GmbH)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
Dream Aquarium (HKLM-x32\...\DreamAqua) (Version:  - )
Dream Day Wedding Collector Set (HKLM-x32\...\119498770) (Version:  - Oberon Media)
Duden-Bibliothek (HKLM-x32\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.1.0 - Bibliographisches Institut GmbH)
EMBASSY Security Center (Version: 04.03.00.121 - Wave Systems Corp.) Hidden
ePub DRM Removal (HKLM-x32\...\ePubDRMRemoval) (Version: 1.4.1 - eBook Converter)
Free M4a to MP3 Converter 7.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free Studio version 5.9.0.1212 (HKLM-x32\...\Free Studio_is1) (Version: 5.9.0.1212 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.43.806 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.43.806 - DVDVideoSoft Ltd.)
GameCatalog21.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
GameCatalog32.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
Gemalto (Version: 01.64.01.0010 - Wave Systems Corp) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
High-Logic FontCreator 6.5 (HKLM-x32\...\FontCreator6_is1) (Version:  - High-Logic B.V.)
Incredible Worlds Double Pack (HKLM-x32\...\510009534) (Version:  - Oberon Media)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.27.0 (HKLM-x32\...\{F109D156-577D-101B-A622-CF4351943AA4}) (Version: 1.2.27.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections 16.5.2.0 (HKLM\...\PROSetDX) (Version: 16.5.2.0 - Dell)
Intel(R) Network Connections 16.5.2.0 (Version: 16.5.2.0 - Dell) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3040 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kindle DRM Removal (HKLM-x32\...\KindleDRMRemoval) (Version: 1.4.1 - eBook Converter)
Lost Souls - Timeless Fables (HKLM-x32\...\510009657) (Version:  - Oberon Media)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.2 - Notepad++ Team)
NTRU TCG Software Stack (Version: 2.1.36 - Security Innovation, Inc.) Hidden
NVIDIA 3D Vision Treiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 306.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
NVIDIA nView 136.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 136.53 - NVIDIA Corporation)
NVIDIA nView Desktop Manager (Version: 6.14.10.13585 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.0697 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
O2Micro Flash Memory Card Windows Driver (HKLM-x32\...\InstallShield_{0CB3B7EE-52C7-4136-AF40-605567D90318}) (Version: 3.0.07.23 - O2Micro International LTD.)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.0.07.23 - O2Micro International LTD.) Hidden
Oracle VM VirtualBox 4.2.10 (HKLM\...\{E28F112D-4784-4466-AE4B-07B3630C857F}) (Version: 4.2.10 - Oracle Corporation)
PC-CCID (Version: 2.0.0 - Gemalto) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Preboot Manager (Version: 03.03.00.074 - Wave Systems Corp.) Hidden
Private Information Manager (Version: 07.01.00.022 - Wave Systems Corp.) Hidden
Product Key Explorer 3.1.3 (HKLM-x32\...\Product Key Explorer_is1) (Version:  - Nsasoft, LLC.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Reader Library by Sony (HKLM-x32\...\{B70E5793-F912-4C62-AFE2-C4F0B078FD31}) (Version: 3.3.00.07130 - Sony)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SPBA 5.9 (Version: 5.9.4.6686 - UPEK Inc.) Hidden
Tales of Monkey Island (HKLM-x32\...\Tales of Monkey Island) (Version: 3.0.0.0 - Daedalic Entertainment)
Trusted Drive Manager (Version: 4.1.1.312 - Wave Systems Corp.) Hidden
Upek Touchchip Fingerprint Reader (Version: 1.2.004 - Dell Inc.) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wave Infrastructure Installer (Version: 07.67.17.0010 - Wave Systems Corp) Hidden
Wave Support Software Installer (Version: 05.13.00.033 - Wave Systems Corp) Hidden
WD Drive Utilities (HKLM-x32\...\{2D2BD030-2DC0-478F-9710-3554FFC0D797}) (Version: 1.0.7.3 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{B7063C41-A5D1-482D-BE07-34750B26950B}) (Version: 2.1.0.11 - Western Digital Technologies, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Mobile Device Updater Component (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (HKLM\...\9512AA21B791B05A54E27065C45BBC417AB282DF) (Version: 09/11/2009 1.0.1.6 - Dell Inc.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

15-10-2014 17:57:23 Geplanter Prüfpunkt
16-10-2014 05:26:47 Windows Update
16-10-2014 05:39:58 Dell Updates
16-10-2014 06:16:05 Windows Update
19-10-2014 18:30:14 Windows Update
24-10-2014 19:43:35 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-12-11 11:45 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0D5B5C33-BF55-4405-AF6B-9B9B2F96FFDF} - System32\Tasks\Dell\Command Update => C:\Program Files (x86)\Dell\CommandUpdate\DellCommandUpdate.exe [2014-05-05] (Dell Inc.)
Task: {114FC741-9B27-47C3-9ED2-47F49B05D0E7} - System32\Tasks\{663BB892-4617-4AAA-80FF-9CE6AB2EF84B} => D:\SETUP.EXE
Task: {3B3F041A-FBAD-4FA5-8E80-3058867E388F} - System32\Tasks\{A7811205-CFFE-4128-A888-06213E056FA9} => D:\SETUP.EXE
Task: {43C15320-82CE-4EE8-8D1E-85A4A0A895C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-16] (Adobe Systems Incorporated)
Task: {4BF51701-F960-4733-A460-5D59D7D1BF60} - System32\Tasks\{4FCB3C49-EC9A-42AE-955A-2660C771F716} => D:\SETUP.EXE
Task: {6DA8F52E-B150-4485-AC34-0EFF1ACD2EF9} - System32\Tasks\{47ED87FF-0DE0-4BF6-AA69-E0A9DA1F22B5} => D:\SETUP.EXE
Task: {70D7B408-C8CE-4C44-B35F-322796755FC5} - System32\Tasks\Western Digital\SmartWare\____Volume_c2befd37_4105_11e1_814f_806e6f6e6963______Volume_03d5da04_e37b_11e3_9737_806e6f6e6963__ => C:\Program Files (x86)\Western Digital\WD SmartWare\BackupTask.exe [2013-06-19] (Western Digital Technologies, Inc.)
Task: {763CD2A9-4CE9-4F8A-85D2-B22F4162EDF3} - System32\Tasks\{4C263F9F-6591-4176-A528-7A43E0982B21} => D:\SETUP.EXE
Task: {81D19C03-FD1A-4150-A557-4D27C1A5D378} - System32\Tasks\{940BD94B-3269-4761-A0FB-B983B98A2045} => D:\SETUP.EXE
Task: {8BC414D6-566A-4EC5-9D8E-274581059BB7} - System32\Tasks\{8CB751C0-FFB0-42CC-B28A-30393C059C63} => D:\SETUP.EXE
Task: {912C4EF3-C2DB-4BC2-9DFB-5FC97B89C0F3} - System32\Tasks\{C14A32B9-BA4A-43AD-8B71-AFD967ED9CC1} => D:\SETUP.EXE
Task: {A2AFDEC9-90E8-4A3A-A889-0E27A7D91A1F} - System32\Tasks\{A0D6453B-6605-4745-9EE1-4CC2517D1D74} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {A794C86B-E2FD-4ADD-BAED-77CAE988746C} - System32\Tasks\{40095177-C9DC-4551-8F92-11A2707DB678} => D:\SETUP.EXE
Task: {B0E6EF93-DA75-42E7-88A4-E79A748E04DA} - System32\Tasks\{BEC3D6AC-7C9A-4CE1-AAC3-33E212D75251} => D:\SETUP.EXE
Task: {B4E59951-ED1F-4B92-B88B-561A7D1CEC44} - System32\Tasks\AdobeAAMUpdater-1.0-Wulli-Constanze => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-01-24] (Adobe Systems Incorporated)
Task: {C2F82158-E617-4FC6-B3A3-F1D7426370C6} - System32\Tasks\{F09AB0D1-E6C1-4052-B95C-5BDD54229614} => D:\SETUP.EXE
Task: {C4AFF9BD-4EAE-4AE8-BB63-E5C11B4CB061} - System32\Tasks\{2744E3A0-78AC-4250-BE65-9E60B92308B6} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {CD5DBC02-859F-4C2A-B471-44E6D3FE2319} - System32\Tasks\{66EC3D49-3FAF-4BD7-BFC3-275842B25861} => D:\SETUP.EXE
Task: {CFECC2D4-1AF3-4F3D-9ACA-5CF8CDC3156A} - System32\Tasks\{BE9068AA-3BD0-4090-B0F1-A6DA4ECF6E40} => D:\SETUP.EXE
Task: {D7658736-0F71-4E6F-BB5F-4AC63C1FC9E1} - System32\Tasks\{ABB68144-B87A-424A-9633-21CA29D080D4} => D:\SETUP.EXE
Task: {DE7D347C-6DB5-4C96-84F0-807527BFC0B5} - System32\Tasks\{5AAFE2D1-5A6E-4EE1-B573-B952C3363EBE} => D:\SETUP.EXE
Task: {E9DC5837-283F-4BDD-9E60-4FB5295583B0} - System32\Tasks\{B5382562-EFCB-4992-9715-2AB036EA833F} => D:\SETUP.EXE
Task: {ED9B950E-BF5C-4659-B621-714280868F9B} - System32\Tasks\{FC0195C6-64AF-4E53-99BE-E481706A9022} => D:\SETUP.EXE
Task: {FAC722AA-8578-479E-84DE-EF32AF6F9807} - System32\Tasks\{A56937AB-F66A-469E-A556-B67BD0AE0C15} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-01-03 12:39 - 2012-10-02 20:51 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-01-17 20:53 - 2003-04-19 03:06 - 00008192 ____N () c:\Windows\SysWOW64\srvany.exe
2012-07-01 20:10 - 2010-03-16 00:18 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2012-01-17 22:07 - 2011-06-10 19:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-01-17 20:51 - 2012-09-05 11:51 - 00686744 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2012-07-01 20:10 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2010-07-13 00:28 - 2010-07-13 00:28 - 00856064 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\fsk.dll
2010-07-13 00:13 - 2010-07-13 00:13 - 00033792 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMediaPlayers.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00233472 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\Fskin.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00020480 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskinLocalize.dll
2010-04-02 20:23 - 2010-04-02 20:23 - 00815104 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskSecurity.dll
2010-07-13 00:16 - 2010-07-13 00:16 - 00118784 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskDocumentViewer.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00009728 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskPower.dll
2010-07-13 00:26 - 2010-07-13 00:26 - 00018432 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskNetInterface.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00010240 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMobileMediaDevice.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00008704 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00028160 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ticket.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00011776 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll
2010-04-02 19:44 - 2010-04-02 19:44 - 00086016 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookUsb.dll
2010-07-13 00:29 - 2010-07-13 00:29 - 00143360 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\connectionDetector.dll
2010-07-13 00:10 - 2010-07-13 00:10 - 00172032 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\USBDetector.dll
2013-09-03 14:54 - 2013-09-03 14:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\acrotray.deu

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:0EFEBFCB
AlternateDataStreams: C:\ProgramData\Temp:214562D2
AlternateDataStreams: C:\ProgramData\Temp:215C73EE
AlternateDataStreams: C:\ProgramData\Temp:2307DBD5
AlternateDataStreams: C:\ProgramData\Temp:3DBF3B08
AlternateDataStreams: C:\ProgramData\Temp:49B71832
AlternateDataStreams: C:\ProgramData\Temp:6126E9A8
AlternateDataStreams: C:\ProgramData\Temp:C91E924C
AlternateDataStreams: C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

========================= Accounts: ==========================

Administrator (S-1-5-21-3530594910-3682233180-4012714100-500 - Administrator - Disabled)
Constanze (S-1-5-21-3530594910-3682233180-4012714100-1001 - Administrator - Enabled) => C:\Users\Constanze
Gast (S-1-5-21-3530594910-3682233180-4012714100-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3530594910-3682233180-4012714100-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3530594910-3682233180-4012714100-1000 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2012-12-11 11:44:57.909
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-12-11 11:44:57.894
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 25%
Total physical RAM: 8073.02 MB
Available physical RAM: 6052.14 MB
Total Pagefile: 16144.21 MB
Available Pagefile: 13957.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:219.2 GB) (Free:54.66 GB) NTFS
Drive e: (My Book) (Fixed) (Total:1862.98 GB) (Free:1287.15 GB) NTFS
Drive f: (LaCie) (Fixed) (Total:931.51 GB) (Free:578.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 7F8BABDA)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=13.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=219.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: D0C07B02)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: EE0538F2)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Der Rechner hat drei Anläufe gebraucht, um wieder hochzufahren. Der Echtzeitscanner von Avira hat sich nur mit Überreden wieder starten lassen. Statt des normalen Avira-Fensters kam ein kleines grünes Viereck mit einem Button "Foto wechseln". In "Programme" ist bei Avira noch ein zweites namesn "My Avira". Das ist mir vorher nie aufgefallen.

Gruß
sparkle

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Hi Schrauber,
bin gerade (zu) selten zu Hause. Freue mich aber schon darauf, dort den Resten der Malware den Gar aus zu machen.
Bis dann
Sparkle

ok

Hallo Schrauber,

da ist noch was.

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=15d178253e593048b1cd25487e97b344
# engine=20876
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-11-01 05:13:20
# local_time=2014-11-01 06:13:20 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 35033 159370978 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 35022 166448650 0 0
# scanned=323722
# found=15
# cleaned=0
# scan_time=33961
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=99F97AD369E8621AB4D17DF53E80E60FEE99C727 ft=1 fh=42567613b862d846 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Constanze\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=9CA71C727934861E9351AF97CC28CEA38811B07C ft=1 fh=15a0a042e9313939 vn="Variante von Win32/AdWare.Adpeak.G Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\netfilter64.sys.vir"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \wajam_validate.exe-k.mbam"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \wajam_validate.exe-r.mbam"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \wajam_validate.exe-u.mbam"
sh=5F88E04A4FA9F4E89A16C8EFEFC0C84C624E68B2 ft=1 fh=4ca83169c6e2a282 vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\Programme-mobil\VG-JPEG-Repair-lnstall.exe"
sh=E85CA4BE2EEFB55E542B799BC291CE54F29C86C3 ft=1 fh=27d5affd83353fc5 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Programme-mobil\kaleidoscope\Kaleidoscope - CHIP-Installer.exe"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Malwarebytes\ Malwarebytes Anti-Malware \wajam_validate.exe-k.mbam"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Malwarebytes\ Malwarebytes Anti-Malware \wajam_validate.exe-r.mbam"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Malwarebytes\ Malwarebytes Anti-Malware \wajam_validate.exe-u.mbam"
sh=650BC7EB262B7DC3B5100183857C3F5270B290E8 ft=1 fh=bdda410eaf6f586a vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Constanze\AppData\Local\Temp\optprosetup.exe"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Constanze\AppData\Local\Temp\is1275519350\1411209_stp\wajam_validate.exe"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Constanze\AppData\Local\Temp\is1275519350\271884550_stp\wajam_validate.exe"
sh=771FF9244089896A1105B2D3EC26B9ADE08B1D97 ft=0 fh=0000000000000000 vn="Variante von Java/Exploit.Agent.OBF Trojaner" ac=I fn="C:\Users\Constanze\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\5cc303d8-64464fe4"
         

 Results of screen317's Security Check version 0.99.89  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 15.0.0.189  
 Mozilla Firefox 32.0.3 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

In meinem Notepad++ hat sich ein weiteres Log geöffnet mit dem irren Datum 12.02.12. Hier ist es:

12/02/12  19:23:44  INFORMATION  0  Log file has been created
12/02/12  19:23:44  INFORMATION  0  INF path registry store has been created: SOFTWARE\GEAR Software\DIFx\{22D8AE6F-3C6B-47E8-8F04-629F23DBE978}.
12/02/12  19:23:44  INFORMATION  0  The INSTALL function has been called.
12/02/12  19:23:44  INFORMATION  0  The INSTALL function has started.
12/02/12  19:23:44  INFORMATION  0  Enter SetDriverFileAttribs()
12/02/12  19:23:44  INFORMATION  0  C:\Windows\system32\drivers\GEARAspiWDM.sys exists.
12/02/12  19:23:44  INFORMATION  0  File is not read-only: C:\Windows\system32\drivers\GEARAspiWDM.sys .
12/02/12  19:23:44  INFORMATION  0  C:\Windows\system32\GEARAspi64.dll exists.
12/02/12  19:23:44  INFORMATION  0  File is not read-only: C:\Windows\system32\GEARAspi64.dll .
12/02/12  19:23:44  INFORMATION  0  C:\Windows\SysWOW64\GEARAspi.dll exists.
12/02/12  19:23:44  INFORMATION  0  File is not read-only: C:\Windows\SysWOW64\GEARAspi.dll .
12/02/12  19:23:44  INFORMATION  0  Leave SetDriverFileAttribs()
12/02/12  19:23:44  INFORMATION  0  Driver package installed successfully
12/02/12  19:23:44  INFORMATION  0  Creating legacy driver installation place holder.
12/02/12  19:23:44  INFORMATION  0  Driver package (Legacy) installed successfully
12/02/12  19:23:44  INFORMATION  0  Installing ASPI DLL's.
12/02/12  19:23:44  INFORMATION  0  Enter InstallDLL()
12/02/12  19:23:45  INFORMATION  0  GEARAspi64.dll installed successfully.
12/02/12  19:23:46  INFORMATION  0  GEARAspi.dll installed successfully.
12/02/12  19:23:46  INFORMATION  0  Leave InstallDLL()
12/02/12  19:23:46  INFORMATION  0  Incrementing shared DLL entries.
12/02/12  19:23:46  INFORMATION  0  Enter SetDriverFileAttribs()
12/02/12  19:23:46  INFORMATION  0  C:\Windows\system32\drivers\GEARAspiWDM.sys exists.
12/02/12  19:23:46  INFORMATION  0  File is not read-only: C:\Windows\system32\drivers\GEARAspiWDM.sys .
12/02/12  19:23:46  INFORMATION  0  C:\Windows\system32\GEARAspi64.dll exists.
12/02/12  19:23:46  INFORMATION  0  File is not read-only: C:\Windows\system32\GEARAspi64.dll .
12/02/12  19:23:46  INFORMATION  0  C:\Windows\SysWOW64\GEARAspi.dll exists.
12/02/12  19:23:46  INFORMATION  0  File is not read-only: C:\Windows\SysWOW64\GEARAspi.dll .
12/02/12  19:23:46  INFORMATION  0  Leave SetDriverFileAttribs()
12/02/12  19:23:46  INFORMATION  0  The INSTALL function has completed.
12/02/12  20:18:23  INFORMATION  0  Log file has been created
12/02/12  20:18:23  INFORMATION  0  INF path registry store has been created: SOFTWARE\GEAR Software\DIFx\{22D8AE6F-3C6B-47E8-8F04-629F23DBE978}.
12/02/12  20:18:23  INFORMATION  0  The UNINSTALL function has been called.
12/02/12  20:18:23  INFORMATION  0  Retrieving the driver's INF file path.
12/02/12  20:18:23  INFORMATION  0  Driver package uninstalled successfully
12/02/12  20:18:23  INFORMATION  0  Decrementing shared DLL entries.
12/02/12  20:18:23  INFORMATION  0  Removing the legacy driver installation place holder.
12/02/12  20:18:24  INFORMATION  0  Removing ASPI DLL's.
12/02/12  20:18:24  INFORMATION  0  Registry values indicate that no other applications depend on this driver.  Removing associated UpperFilter and Service registry entries.
12/02/12  20:18:24  INFORMATION  0  RemoveUpperFilter( DEVICECLASS_CDROM )
12/02/12  20:18:24  INFORMATION  0  The UpperFilters entry was previously removed.
12/02/12  20:18:24  SUCCESS      0  UpperFilter removal success for DEVICECLASS_CDROM.
12/02/12  20:18:24  INFORMATION  0  RemoveUpperFilter( DEVICECLASS_TAPE )
12/02/12  20:18:24  INFORMATION  0  The UpperFilters entry was previously removed.
12/02/12  20:18:24  SUCCESS      0  UpperFilter removal success for DEVICECLASS_TAPE.
12/02/12  20:18:24  INFORMATION  0  RemoveUpperFilter( DEVICECLASS_JUKE )
12/02/12  20:18:24  INFORMATION  0  The UpperFilters entry was previously removed.
12/02/12  20:18:24  SUCCESS      0  UpperFilter removal success for DEVICECLASS_JUKE.
12/02/12  20:18:24  SUCCESS      0  Service entry removal success.
12/02/12  20:18:24  INFORMATION  0  Forcing removal of remaining legacy driver registry entries, if any.
12/02/12  20:18:24  INFORMATION  0  A reboot will be required to complete the installation
12/02/12  20:39:13  INFORMATION  0  Log file has been created
12/02/12  20:39:13  INFORMATION  0  INF path registry store has been created: SOFTWARE\GEAR Software\DIFx\{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}.
12/02/12  20:39:13  INFORMATION  0  The UNINSTALL function has been called.
12/02/12  20:39:13  INFORMATION  0  Retrieving the driver's INF file path.
12/02/12  20:39:13  INFORMATION  0  Driver package uninstalled successfully
12/02/12  20:39:13  INFORMATION  0  Decrementing shared DLL entries.
12/02/12  20:39:13  INFORMATION  0  Removing the legacy driver installation place holder.
12/02/12  20:39:13  INFORMATION  0  Removing ASPI DLL's.
12/02/12  20:39:13  INFORMATION  0  Registry values indicate that no other applications depend on this driver.  Removing associated UpperFilter and Service registry entries.
12/02/12  20:39:13  INFORMATION  0  RemoveUpperFilter( DEVICECLASS_CDROM )
12/02/12  20:39:13  INFORMATION  0  The UpperFilters entry was previously removed.
12/02/12  20:39:13  SUCCESS      0  UpperFilter removal success for DEVICECLASS_CDROM.
12/02/12  20:39:13  INFORMATION  0  RemoveUpperFilter( DEVICECLASS_TAPE )
12/02/12  20:39:13  INFORMATION  0  The UpperFilters entry was previously removed.
12/02/12  20:39:13  SUCCESS      0  UpperFilter removal success for DEVICECLASS_TAPE.
12/02/12  20:39:13  INFORMATION  0  RemoveUpperFilter( DEVICECLASS_JUKE )
12/02/12  20:39:13  INFORMATION  0  The UpperFilters entry was previously removed.
12/02/12  20:39:13  SUCCESS      0  UpperFilter removal success for DEVICECLASS_JUKE.
12/02/12  20:39:13  SUCCESS      0  Service entry removal success.
12/02/12  20:39:13  INFORMATION  0  Forcing removal of remaining legacy driver registry entries, if any.
12/02/12  20:39:13  INFORMATION  0  A reboot will be required to complete the installation
         

Ich habe nicht rebootet, nur meinen Virenscanner wieder angemacht. Wenn ich meinen Rechner durchsuche, finde ich keine GearSoftware. Ich habe das kurz gegoogelt. Ich habe den CD-BurnerXP und das DVD VideoSoft Freee Studio, Eine CD oder DVD liegt auch nicht im Laufwerk.

Das zweite Tab meines Browsers ist immer noch "chrome://quick_start/content/index.html".

Ich bin gespannt auf Deine Antwort.

Gruß
Sparkle

Das frische FRST log fehlt noch

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-11-2014
Ran by Constanze (administrator) on WULLI on 01-11-2014 21:11:11
Running from C:\Users\Constanze\Desktop
Loaded Profiles: Constanze (Available profiles: UpdatusUser & Constanze)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-

farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin

\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin

\HostStorageService.exe
(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager

\TdmService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
() C:\Windows\SysWOW64\srvany.exe
(O2Micro.) C:\Windows\SysWOW64\SDIOAssist.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager

\WaveAMService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager

\TdmNotify.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform

\OSPPSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA

\updaterstartuputility.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [DFEPApplication] => C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe [7077432 

2012-08-15] (Dell Inc.)
HKLM\...\Run: [TdmNotify] => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive 

Manager\TdmNotify.exe [257392 2011-05-28] (Wave Systems Corp.)
HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft 

Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA

\UpdaterStartupUtility.exe [477600 2013-01-24] (Adobe Systems Incorporated)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2041192 2012-10-08] ()
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe 

[686744 2012-09-05] ()
HKLM\...\Run: [Onboard] => C:\Program Files\Western Digital\WD SmartWare\WDSmartWare.exe [3164536 2013-06-19] 

(Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS

\PIconStartup.exe [112408 2011-08-09] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central

\WebcamDell2.exe [462993 2010-03-12] (Creative Technology Ltd)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] 

(Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] 

(Brother Industries, Ltd.)
HKLM-x32\...\Run: [Reader Library Launcher] => C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library 

Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 

[517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager

\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 

2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat

\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 

2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira 

Operations GmbH & Co. KG)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe 

[5524336 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support

\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] 

(Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (UPEK Inc.)
HKU\S-1-5-21-3530594910-3682233180-4012714100-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ISUSPM] 

=> C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
HKU\S-1-5-21-3530594910-3682233180-4012714100-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: 

{c2befd3a-4105-11e1-814f-806e6f6e6963} - D:\start.exe
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA 

Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-08] (NVIDIA 

Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [202600 2012-10-08] (NVIDIA 

Corporation)
AppInit_DLLs-x32: ,C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA 

Corporation)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart 

Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AkrutoSync.lnk
ShortcutTarget: AkrutoSync.lnk -> C:\Program Files\Akruto\AkrutoSync.exe (Akruto)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 

Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office

\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart 

Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart 

Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
ShellIconOverlayIdentifiers: [EnabledUnlockedFDEIconOverlay] -> {30D3C2AF-9709-4D05-9CF4-13335F3C1E4A} => C:

\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave 

Systems Corp.)
ShellIconOverlayIdentifiers: [UninitializedFdeIconOverlay] -> {CF08DA3E-C97D-4891-A66B-E39B28DD270F} => C:

\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave 

Systems Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?

prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {A9F37828-A92C-477B-98B6-04329E3B861F} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files

\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft 

Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin

\jp2ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files 

(x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files 

(x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files 

(x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files

\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files

\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft 

Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft 

Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities

\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.38 -> C:\Program Files (x86)\Intel\Services\IPT

\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT

\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( 

Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft 

Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL 

(Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery

\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery

\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA 

Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision

\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter

\1.0.0.14\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @sony.com/eBookLibrary -> C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony 

Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems 

Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities

\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager 

CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins

\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\gmx-

suche.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins

\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default

\Extensions\abs@avira.com [2014-09-30]
FF Extension: FoxyProxy Standard - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default

\Extensions\foxyproxy@eric.h.jung [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe

\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn 

[2012-09-23]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed 

separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira 

Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations 

GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira 

Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not 

signed]
R2 DFEPService; c:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe [2280504 2012-08-15] (Dell Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] 

(Malwarebytes Corporation)
R2 O2SDIOAssist; c:\Windows\SysWOW64\srvany.exe [8192 2003-04-19] () [File not signed]
S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 

2010-04-02] (Sony Corporation) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] 

(Adobe Systems Incorporated) [File not signed]
S2 tcsd_win32.exe; C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1633280 

2011-02-17] () [File not signed]
R2 Wave Authentication Manager Service; C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave

\Authentication Manager\WaveAMService.exe [1600000 2011-07-01] (Wave Systems Corp.) [File not signed]
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2013-06-19] 

(Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [270704 2013-11-20] 

(Western Digital Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed 

separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-29] (Avira Operations GmbH & Co. KG)
S3 HBtnKey; C:\Windows\system32\drivers\HBtnKey.sys [20424 2011-07-19] (Dell Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-01] (Malwarebytes 

Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-03-15] (Oracle Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to 

be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-01 21:10 - 2014-11-01 21:10 - 00000000 ____D () C:\Users\Constanze\Desktop\FRST-OlderVersion
2014-11-01 08:41 - 2014-11-01 08:41 - 00000853 _____ () C:\Users\Constanze\Desktop\checkup.txt
2014-10-31 21:46 - 2014-10-31 21:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-31 20:44 - 2014-10-31 20:44 - 02347384 _____ (ESET) C:\Users\Constanze\Desktop\esetsmartinstaller_deu.exe
2014-10-31 20:44 - 2014-10-31 20:44 - 00854448 _____ () C:\Users\Constanze\Desktop\SecurityCheck.exe
2014-10-27 21:39 - 2014-10-27 21:41 - 00000000 ____D () C:\Users\Constanze\Desktop\Etiketten für dei Arbeit
2014-10-27 21:16 - 2014-10-27 21:16 - 00027998 _____ () C:\Users\Constanze\Desktop\Addition.txt
2014-10-27 21:14 - 2014-11-01 21:11 - 00022583 _____ () C:\Users\Constanze\Desktop\FRST.txt
2014-10-27 21:07 - 2014-10-27 21:14 - 00001982 _____ () C:\Users\Constanze\Desktop\JRT.txt
2014-10-27 20:46 - 2014-10-27 20:46 - 00004911 _____ () C:\Users\Constanze\Desktop\AdwCleaner[S1].txt
2014-10-27 19:19 - 2014-10-27 19:19 - 01706144 _____ (Thisisu) C:\Users\Constanze\Desktop\JRT.exe
2014-10-27 19:18 - 2014-10-27 19:18 - 01998336 _____ () C:\Users\Constanze\Desktop\AdwCleaner_4.002.exe
2014-10-26 21:11 - 2014-10-26 21:43 - 00063316 _____ () C:\Users\Constanze\Desktop\AVSCAN-20141024-220424-

4503797A.LOG
2014-10-26 20:36 - 2014-10-26 20:36 - 00032890 _____ () C:\Users\Constanze\Desktop\Gmer.txt
2014-10-26 19:47 - 2014-10-26 19:48 - 00036042 _____ () C:\Users\Constanze\Desktop\Addition26.10.2014.txt
2014-10-26 19:46 - 2014-10-26 19:48 - 00046401 _____ () C:\Users\Constanze\Desktop\FRST26.10.2014.txt
2014-10-26 19:44 - 2014-10-26 19:44 - 00000480 _____ () C:\Users\Constanze\Desktop\defogger_disable.log
2014-10-26 19:31 - 2014-10-26 19:31 - 00380416 _____ () C:\Users\Constanze\Desktop\Gmer-19357.exe
2014-10-26 19:30 - 2014-11-01 21:10 - 02114048 _____ (Farbar) C:\Users\Constanze\Desktop\FRST64.exe
2014-10-26 19:29 - 2014-10-26 19:29 - 00050477 _____ () C:\Users\Constanze\Desktop\Defogger.exe
2014-10-24 22:02 - 2014-10-24 22:02 - 00020802 _____ () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite.xht
2014-10-24 22:02 - 2014-10-24 22:02 - 00000000 ____D () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite-

Dateien
2014-10-24 21:02 - 2014-10-24 21:02 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\BandExtend
2014-10-24 15:41 - 2014-10-24 16:16 - 00015135 _____ () C:\Users\Constanze\Desktop\Ruggl_schlüssel.xlsx
2014-10-24 14:48 - 2014-10-24 14:48 - 00000000 ____D () C:\Users\Constanze\Downloads\Archiv
2014-10-24 14:45 - 2014-10-24 14:47 - 01123346 _____ () C:\Users\Constanze\Downloads\WordCreatorWin.zip
2014-10-23 20:45 - 2014-10-23 20:45 - 00001099 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\Adobe Content Viewer.lnk
2014-10-23 20:33 - 2014-10-23 20:33 - 00005632 _____ () C:\Users\Constanze\Documents\Dokument4.zdl
2014-10-23 20:33 - 2014-10-23 20:33 - 00005120 _____ () C:\Users\Constanze\Documents\Dokument3.zdl
2014-10-16 07:05 - 2014-10-16 07:05 - 00000000 ____D () C:\Windows\{B7231620-E76C-4C8E-ADD5-594B1C9FF72F}
2014-10-16 06:38 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 06:38 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 06:38 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 06:38 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 06:38 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 06:38 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 06:38 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 06:38 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 06:38 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 06:38 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows

\system32\ieetwcollectorres.dll
2014-10-16 06:38 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows

\system32\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 06:38 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 06:38 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 06:38 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows

\system32\MsSpellCheckingFacility.exe
2014-10-16 06:38 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 06:38 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows

\system32\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 06:38 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 06:38 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 06:38 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 06:38 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 06:38 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 06:38 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 06:38 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 06:38 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 06:38 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 06:38 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 06:38 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 06:37 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 06:37 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 06:37 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 06:37 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 06:37 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 06:36 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 06:36 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-05 21:41 - 2014-10-05 21:41 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Fenomen Games
2014-10-05 21:39 - 2014-10-05 21:40 - 00002299 _____ () C:\Users\Constanze\Desktop\Lost Souls - Timeless Fables.lnk
2014-10-04 22:55 - 2014-10-04 22:55 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Urchin

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-01 21:11 - 2014-02-25 09:40 - 00000000 ____D () C:\FRST
2014-11-01 21:09 - 2012-03-28 17:43 - 00000000 ____D () C:\Users\Constanze\Documents\Outlook-Dateien
2014-11-01 20:41 - 2014-08-23 11:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers

\MBAMSwissArmy.sys
2014-11-01 20:21 - 2012-04-26 19:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-01 19:21 - 2009-07-14 05:51 - 00183634 _____ () C:\Windows\setupact.log
2014-11-01 14:32 - 2012-01-17 13:24 - 01810257 _____ () C:\Windows\WindowsUpdate.log
2014-11-01 09:12 - 2014-03-05 19:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-31 20:42 - 2010-11-21 07:50 - 08086616 _____ () C:\Windows\system32\perfh007.dat
2014-10-31 20:42 - 2010-11-21 07:50 - 02519980 _____ () C:\Windows\system32\perfc007.dat
2014-10-31 20:42 - 2009-07-14 06:13 - 00006512 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-31 20:39 - 2012-06-27 18:02 - 00000682 _____ () C:\Windows\BRCALIB.INI
2014-10-31 20:33 - 2014-08-18 19:06 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Adobe
2014-10-31 20:31 - 2014-06-19 16:09 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Akruto
2014-10-31 20:31 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327

-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-31 20:31 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327

-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-31 20:23 - 2014-09-12 01:19 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2014-10-31 20:23 - 2012-01-17 13:24 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-31 20:23 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-28 22:00 - 2013-03-10 21:42 - 00000000 ____D () C:\Users\Constanze\Documents\Calibre Bibliothek
2014-10-28 06:34 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-27 22:01 - 2012-01-17 21:07 - 00000000 ____D () C:\ProgramData\Temp
2014-10-27 20:56 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-10-27 20:56 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\system32\NV
2014-10-27 19:28 - 2010-11-21 04:47 - 00430370 _____ () C:\Windows\PFRO.log
2014-10-27 19:27 - 2014-03-05 19:29 - 00001067 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\Mozilla Firefox.lnk
2014-10-27 19:27 - 2014-02-27 18:24 - 00000000 ____D () C:\AdwCleaner
2014-10-27 19:27 - 2012-05-02 20:48 - 00001162 _____ () C:\Users\Constanze\Desktop\Internet Explorer.lnk
2014-10-27 19:27 - 2012-01-24 21:42 - 00001005 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start 

Menu\Programs\Internet Explorer.lnk
2014-10-26 19:05 - 2014-07-13 16:43 - 00009331 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-

2003.EML
2014-10-26 18:42 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Abos Vereine
2014-10-26 18:28 - 2012-03-28 16:13 - 00000000 ____D () C:\Users\Constanze\Documents\Briefe diverse Empfänger
2014-10-24 14:49 - 2014-07-14 19:53 - 02959872 _____ () C:\Users\Constanze\Downloads\WordCreator.exe
2014-10-23 20:45 - 2012-01-17 21:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-10-23 20:44 - 2012-09-23 19:23 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2013-04-16 20:49 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-22 20:58 - 2014-06-28 12:31 - 00000000 ____D () C:\Windows\rescache
2014-10-19 18:32 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\Accessories
2014-10-19 18:31 - 2009-07-14 05:45 - 05048656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-19 18:27 - 2014-05-07 23:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 07:30 - 2012-01-24 21:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 07:26 - 2013-08-14 21:44 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 07:16 - 2012-03-29 19:44 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-16 07:05 - 2012-01-24 21:43 - 00000000 ____D () C:\Windows\System32\Tasks\Dell
2014-10-16 07:05 - 2012-01-24 21:42 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Dell
2014-10-16 07:05 - 2012-01-17 20:59 - 00000000 ____D () C:\ProgramData\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\Program Files (x86)\Dell
2014-10-16 06:28 - 2012-04-26 19:22 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows

\SysWOW64\FlashPlayerApp.exe
2014-10-16 06:28 - 2012-01-17 20:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows

\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 07:51 - 2013-10-16 20:37 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\Avira
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-15 07:49 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Adressen
2014-10-14 20:01 - 2013-05-07 18:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers

\avnetflt.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers

\avipbb.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers

\avgntflt.sys
2014-10-12 22:17 - 2012-07-14 21:53 - 00000000 ____D () C:\Users\Constanze\Documents\ePub DRM Removal
2014-10-06 23:00 - 2013-03-10 21:42 - 00000932 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\calibre 64bit - E-book Management
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\Program Files\Calibre2
2014-10-06 22:54 - 2014-01-25 21:28 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start 

Menu\Programs\Iplay
2014-10-05 21:38 - 2014-01-25 21:28 - 00000000 ____D () C:\Program Files (x86)\Oberon Media SIDR
2014-10-05 20:15 - 2012-09-23 20:06 - 00001456 _____ () C:\Users\Constanze\AppData\Local\Adobe Für Web speichern 

13.0 Prefs

Some content of TEMP:
====================
C:\Users\Constanze\AppData\Local\Temp\1xt0f5po.jrz.exe
C:\Users\Constanze\AppData\Local\Temp\avgnt.exe
C:\Users\Constanze\AppData\Local\Temp\heg3os5n.xrz.exe
C:\Users\Constanze\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Constanze\AppData\Local\Temp\optprosetup.exe
C:\Users\Constanze\AppData\Local\Temp\Quarantine.exe
C:\Users\Constanze\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Constanze\AppData\Local\Temp\sdapskill.exe
C:\Users\Constanze\AppData\Local\Temp\sdaspwn.exe
C:\Users\Constanze\AppData\Local\Temp\sqlite3.dll
C:\Users\Constanze\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\Users\Constanze\AppData\Local\Temp\WEB.DE_MailCheck_FF_Setup_2.10.1.1735.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-27 20:11

==================== End Of Log ============================
         

--- --- ---

Grüße
sparkle

Hallo Schrauber,

gestern Nacht ist mir eingefallen, dass ich vergessen hatte, Dir den FRST-log "Addition txt". zu schicken. Ich habe erst unter den Logs gekuckt und dann habe ich den Rechner durchsucht. Es gibt keinen "Addition-txt" von gestern. Also nach mal frisch:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-11-2014
Ran by Constanze (administrator) on WULLI on 02-11-2014 12:14:55
Running from C:\Users\Constanze\Desktop
Loaded Profiles: Constanze (Available profiles: UpdatusUser & Constanze)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
() C:\Windows\SysWOW64\srvany.exe
(O2Micro.) C:\Windows\SysWOW64\SDIOAssist.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [DFEPApplication] => C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe [7077432 2012-08-15] (Dell Inc.)
HKLM\...\Run: [TdmNotify] => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe [257392 2011-05-28] (Wave Systems Corp.)
HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [477600 2013-01-24] (Adobe Systems Incorporated)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2041192 2012-10-08] ()
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686744 2012-09-05] ()
HKLM\...\Run: [Onboard] => C:\Program Files\Western Digital\WD SmartWare\WDSmartWare.exe [3164536 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112408 2011-08-09] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [462993 2010-03-12] (Creative Technology Ltd)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Reader Library Launcher] => C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5524336 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (UPEK Inc.)
HKU\S-1-5-21-3530594910-3682233180-4012714100-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
HKU\S-1-5-21-3530594910-3682233180-4012714100-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {c2befd3a-4105-11e1-814f-806e6f6e6963} - D:\start.exe
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: ,C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AkrutoSync.lnk
ShortcutTarget: AkrutoSync.lnk -> C:\Program Files\Akruto\AkrutoSync.exe (Akruto)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
ShellIconOverlayIdentifiers: [EnabledUnlockedFDEIconOverlay] -> {30D3C2AF-9709-4D05-9CF4-13335F3C1E4A} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)
ShellIconOverlayIdentifiers: [UninitializedFdeIconOverlay] -> {CF08DA3E-C97D-4891-A66B-E39B28DD270F} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {A9F37828-A92C-477B-98B6-04329E3B861F} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.38 -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @sony.com/eBookLibrary -> C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\abs@avira.com [2014-09-30]
FF Extension: FoxyProxy Standard - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\foxyproxy@eric.h.jung [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-09-23]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DFEPService; c:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe [2280504 2012-08-15] (Dell Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 O2SDIOAssist; c:\Windows\SysWOW64\srvany.exe [8192 2003-04-19] () [File not signed]
S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2010-04-02] (Sony Corporation) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S2 tcsd_win32.exe; C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1633280 2011-02-17] () [File not signed]
R2 Wave Authentication Manager Service; C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [1600000 2011-07-01] (Wave Systems Corp.) [File not signed]
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2013-06-19] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [270704 2013-11-20] (Western Digital Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-29] (Avira Operations GmbH & Co. KG)
S3 HBtnKey; C:\Windows\system32\drivers\HBtnKey.sys [20424 2011-07-19] (Dell Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-02] (Malwarebytes Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-03-15] (Oracle Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 12:14 - 2014-11-02 12:15 - 00022718 _____ () C:\Users\Constanze\Desktop\FRST.txt
2014-11-02 12:14 - 2014-11-02 12:14 - 00001330 _____ () C:\Users\Constanze\Desktop\schrauber2014-11-02.txt
2014-11-02 11:48 - 2014-11-02 11:48 - 00001223 _____ () C:\Users\Constanze\Desktop\mbam-Meldung-2014-11-02.txt
2014-11-01 23:34 - 2014-11-01 23:34 - 00875013 _____ () C:\Users\Constanze\Downloads\pg1260-images.epub
2014-11-01 21:12 - 2014-11-01 21:12 - 00045058 _____ () C:\Users\Constanze\Desktop\FRST_2014-11-01.txt
2014-11-01 21:10 - 2014-11-01 21:10 - 00000000 ____D () C:\Users\Constanze\Desktop\FRST-OlderVersion
2014-11-01 08:41 - 2014-11-01 08:41 - 00000853 _____ () C:\Users\Constanze\Desktop\checkup.txt
2014-10-31 21:46 - 2014-10-31 21:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-31 20:44 - 2014-10-31 20:44 - 02347384 _____ (ESET) C:\Users\Constanze\Desktop\esetsmartinstaller_deu.exe
2014-10-31 20:44 - 2014-10-31 20:44 - 00854448 _____ () C:\Users\Constanze\Desktop\SecurityCheck.exe
2014-10-27 21:39 - 2014-10-27 21:41 - 00000000 ____D () C:\Users\Constanze\Desktop\Etiketten für dei Arbeit
2014-10-27 21:16 - 2014-10-27 21:16 - 00027998 _____ () C:\Users\Constanze\Desktop\Addition_2014-10-27.txt
2014-10-27 21:14 - 2014-11-01 21:12 - 00045058 _____ () C:\Users\Constanze\Desktop\FRST_2014-10-27.txt
2014-10-27 21:07 - 2014-10-27 21:14 - 00001982 _____ () C:\Users\Constanze\Desktop\JRT.txt
2014-10-27 20:46 - 2014-10-27 20:46 - 00004911 _____ () C:\Users\Constanze\Desktop\AdwCleaner[S1].txt
2014-10-27 19:19 - 2014-10-27 19:19 - 01706144 _____ (Thisisu) C:\Users\Constanze\Desktop\JRT.exe
2014-10-27 19:18 - 2014-10-27 19:18 - 01998336 _____ () C:\Users\Constanze\Desktop\AdwCleaner_4.002.exe
2014-10-26 21:11 - 2014-10-26 21:43 - 00063316 _____ () C:\Users\Constanze\Desktop\AVSCAN-20141024-220424-4503797A.LOG
2014-10-26 20:36 - 2014-10-26 20:36 - 00032890 _____ () C:\Users\Constanze\Desktop\Gmer.txt
2014-10-26 19:47 - 2014-10-26 19:48 - 00036042 _____ () C:\Users\Constanze\Desktop\Addition26.10.2014.txt
2014-10-26 19:46 - 2014-10-26 19:48 - 00046401 _____ () C:\Users\Constanze\Desktop\FRST26.10.2014.txt
2014-10-26 19:44 - 2014-10-26 19:44 - 00000480 _____ () C:\Users\Constanze\Desktop\defogger_disable.log
2014-10-26 19:31 - 2014-10-26 19:31 - 00380416 _____ () C:\Users\Constanze\Desktop\Gmer-19357.exe
2014-10-26 19:30 - 2014-11-01 21:10 - 02114048 _____ (Farbar) C:\Users\Constanze\Desktop\FRST64.exe
2014-10-26 19:29 - 2014-10-26 19:29 - 00050477 _____ () C:\Users\Constanze\Desktop\Defogger.exe
2014-10-24 22:02 - 2014-10-24 22:02 - 00020802 _____ () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite.xht
2014-10-24 22:02 - 2014-10-24 22:02 - 00000000 ____D () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite-Dateien
2014-10-24 21:02 - 2014-10-24 21:02 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\BandExtend
2014-10-24 14:48 - 2014-10-24 14:48 - 00000000 ____D () C:\Users\Constanze\Downloads\Archiv
2014-10-24 14:45 - 2014-10-24 14:47 - 01123346 _____ () C:\Users\Constanze\Downloads\WordCreatorWin.zip
2014-10-23 20:45 - 2014-10-23 20:45 - 00001099 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Content Viewer.lnk
2014-10-23 20:33 - 2014-10-23 20:33 - 00005632 _____ () C:\Users\Constanze\Documents\Dokument4.zdl
2014-10-23 20:33 - 2014-10-23 20:33 - 00005120 _____ () C:\Users\Constanze\Documents\Dokument3.zdl
2014-10-16 07:05 - 2014-10-16 07:05 - 00000000 ____D () C:\Windows\{B7231620-E76C-4C8E-ADD5-594B1C9FF72F}
2014-10-16 06:38 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 06:38 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 06:38 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 06:38 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 06:38 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 06:38 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 06:38 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 06:38 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 06:38 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 06:38 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 06:38 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 06:38 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 06:38 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 06:38 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 06:38 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 06:38 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 06:38 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 06:38 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 06:38 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 06:38 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 06:38 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 06:38 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 06:38 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 06:38 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 06:38 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 06:38 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 06:38 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 06:37 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 06:37 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 06:37 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 06:37 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 06:37 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 06:36 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 06:36 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-05 21:41 - 2014-10-05 21:41 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Fenomen Games
2014-10-05 21:39 - 2014-10-05 21:40 - 00002299 _____ () C:\Users\Constanze\Desktop\Lost Souls - Timeless Fables.lnk
2014-10-04 22:55 - 2014-10-04 22:55 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Urchin

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 12:14 - 2014-02-25 09:40 - 00000000 ____D () C:\FRST
2014-11-02 12:09 - 2012-03-28 17:43 - 00000000 ____D () C:\Users\Constanze\Documents\Outlook-Dateien
2014-11-02 11:43 - 2014-08-23 11:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-02 11:21 - 2012-04-26 19:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-02 11:16 - 2009-07-14 05:51 - 00183858 _____ () C:\Windows\setupact.log
2014-11-02 11:15 - 2012-01-17 13:24 - 01810899 _____ () C:\Windows\WindowsUpdate.log
2014-11-01 23:49 - 2013-03-10 21:42 - 00000000 ____D () C:\Users\Constanze\Documents\Calibre Bibliothek
2014-11-01 09:12 - 2014-03-05 19:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-31 20:42 - 2010-11-21 07:50 - 08086616 _____ () C:\Windows\system32\perfh007.dat
2014-10-31 20:42 - 2010-11-21 07:50 - 02519980 _____ () C:\Windows\system32\perfc007.dat
2014-10-31 20:42 - 2009-07-14 06:13 - 00006512 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-31 20:39 - 2012-06-27 18:02 - 00000682 _____ () C:\Windows\BRCALIB.INI
2014-10-31 20:33 - 2014-08-18 19:06 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Adobe
2014-10-31 20:31 - 2014-06-19 16:09 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Akruto
2014-10-31 20:31 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-31 20:31 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-31 20:23 - 2014-09-12 01:19 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2014-10-31 20:23 - 2012-01-17 13:24 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-31 20:23 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-28 06:34 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-27 22:01 - 2012-01-17 21:07 - 00000000 ____D () C:\ProgramData\Temp
2014-10-27 20:56 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-10-27 20:56 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\system32\NV
2014-10-27 19:28 - 2010-11-21 04:47 - 00430370 _____ () C:\Windows\PFRO.log
2014-10-27 19:27 - 2014-03-05 19:29 - 00001067 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-27 19:27 - 2014-02-27 18:24 - 00000000 ____D () C:\AdwCleaner
2014-10-27 19:27 - 2012-05-02 20:48 - 00001162 _____ () C:\Users\Constanze\Desktop\Internet Explorer.lnk
2014-10-27 19:27 - 2012-01-24 21:42 - 00001005 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-26 19:05 - 2014-07-13 16:43 - 00009331 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML
2014-10-26 18:42 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Abos Vereine
2014-10-26 18:28 - 2012-03-28 16:13 - 00000000 ____D () C:\Users\Constanze\Documents\Briefe diverse Empfänger
2014-10-24 14:49 - 2014-07-14 19:53 - 02959872 _____ () C:\Users\Constanze\Downloads\WordCreator.exe
2014-10-23 20:45 - 2012-01-17 21:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-10-23 20:44 - 2012-09-23 19:23 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2014-08-23 11:03 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-23 19:59 - 2013-04-16 20:49 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-22 20:58 - 2014-06-28 12:31 - 00000000 ____D () C:\Windows\rescache
2014-10-19 18:32 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-19 18:31 - 2009-07-14 05:45 - 05048656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-19 18:27 - 2014-05-07 23:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 07:30 - 2012-01-24 21:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 07:26 - 2013-08-14 21:44 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 07:16 - 2012-03-29 19:44 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-16 07:05 - 2012-01-24 21:43 - 00000000 ____D () C:\Windows\System32\Tasks\Dell
2014-10-16 07:05 - 2012-01-24 21:42 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Dell
2014-10-16 07:05 - 2012-01-17 20:59 - 00000000 ____D () C:\ProgramData\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\Program Files (x86)\Dell
2014-10-16 06:28 - 2012-04-26 19:22 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 06:28 - 2012-01-17 20:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 07:51 - 2013-10-16 20:37 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-15 07:49 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Adressen
2014-10-14 20:01 - 2013-05-07 18:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-12 22:17 - 2012-07-14 21:53 - 00000000 ____D () C:\Users\Constanze\Documents\ePub DRM Removal
2014-10-06 23:00 - 2013-03-10 21:42 - 00000932 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\Program Files\Calibre2
2014-10-06 22:54 - 2014-01-25 21:28 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Iplay
2014-10-05 21:38 - 2014-01-25 21:28 - 00000000 ____D () C:\Program Files (x86)\Oberon Media SIDR
2014-10-05 20:15 - 2012-09-23 20:06 - 00001456 _____ () C:\Users\Constanze\AppData\Local\Adobe Für Web speichern 13.0 Prefs

Some content of TEMP:
====================
C:\Users\Constanze\AppData\Local\Temp\1xt0f5po.jrz.exe
C:\Users\Constanze\AppData\Local\Temp\avgnt.exe
C:\Users\Constanze\AppData\Local\Temp\heg3os5n.xrz.exe
C:\Users\Constanze\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Constanze\AppData\Local\Temp\optprosetup.exe
C:\Users\Constanze\AppData\Local\Temp\Quarantine.exe
C:\Users\Constanze\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Constanze\AppData\Local\Temp\sdapskill.exe
C:\Users\Constanze\AppData\Local\Temp\sdaspwn.exe
C:\Users\Constanze\AppData\Local\Temp\sqlite3.dll
C:\Users\Constanze\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\Users\Constanze\AppData\Local\Temp\WEB.DE_MailCheck_FF_Setup_2.10.1.1735.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-27 20:11

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-11-2014
Ran by Constanze at 2014-11-02 12:15:13
Running from C:\Users\Constanze\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.10.34 - STMicroelectronics)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.8 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Design Standard (HKLM-x32\...\{0327A4BF-62BF-48BB-8928-B971B749E9E1}) (Version: 6 - Adobe Systems Incorporated)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.4.3 - Adobe Systems, Incorporated)
AkrutoSync 3.2.32 (HKLM\...\{024E90DA-8432-40E9-8B31-3C68D1999A36}) (Version: 3.2.32 - Akruto, Inc.)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
BioAPI Framework (Version: 1.0.2 - Dell Inc.) Hidden
Brother MFL-Pro Suite DCP-9055CDN (HKLM-x32\...\{979742CC-2CBB-49D8-9BEE-C2F7875F5393}) (Version: 1.0.27.0 - Brother Industries, Ltd.)
calibre 64bit (HKLM\...\{7A073C16-B3B5-4913-8457-262B6E17947A}) (Version: 2.5.0 - Kovid Goyal)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.3868 - CDBurnerXP)
Classic Adventures 4-in-1 Bundle (HKLM-x32\...\510007534) (Version:  - Oberon Media)
CNM Codec (HKLM-x32\...\{9725A44A-FBBE-427B-8053-1D5ADD0A85E6}) (Version: 1.00.0000 - C & M International)
Criminal Minds (HKLM-x32\...\510006264) (Version:  - Oberon Media)
Custom (Version: 01.00.00.000 - Wave Systems Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery Manager (HKLM\...\{50B4B603-A4C6-4739-AE96-6C76A0F8A388}) (Version: 1.3.1 - Dell Inc.)
Dell Command | Update (HKLM-x32\...\{EC542D5D-B608-4145-A8F7-749C02BE6D94}) (Version: 2.0.0 - Dell Inc.)
Dell ControlVault Host Components Installer 64 bit (Version: 2.1.6.214 - Broadcom Corporation) Hidden
Dell Data Protection | Access (HKLM-x32\...\{A7D91856-258D-4C87-8041-B170851CE432}) (Version: 2.1.00001.002 - Dell Inc.)
Dell Data Protection | Access (Version: 02.01.01.002 - Wave Systems Corp) Hidden
Dell Data Protection | Access | Drivers (HKLM-x32\...\{4E4E65EE-C456-45AC-B5AD-C62C3A325BD0}) (Version: 2.01.018 - Dell Inc.)
Dell Data Protection | Access | Middleware (HKLM-x32\...\{841CBDD5-4BB5-403E-AEE3-2FADC3890BE8}) (Version: 2.01.010 - Dell Inc.)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Feature Enhancement Pack (HKLM\...\{992D1CE7-A20F-4AB0-9D9D-AFC3418844DA}) (Version: 2.2.1 - Dell)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.134 - ALPS ELECTRIC CO., LTD.)
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.28 - Creative Technology Ltd)
DellAccess (Version: 01.01.00.072 - Wave Systems Corp.) Hidden
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\{D2B31FE6-127F-4E79-8186-F080A282FBC7}) (Version: 1.0.0.46 - Intenium GmbH)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
Dream Aquarium (HKLM-x32\...\DreamAqua) (Version:  - )
Dream Day Wedding Collector Set (HKLM-x32\...\119498770) (Version:  - Oberon Media)
Duden-Bibliothek (HKLM-x32\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.1.0 - Bibliographisches Institut GmbH)
EMBASSY Security Center (Version: 04.03.00.121 - Wave Systems Corp.) Hidden
ePub DRM Removal (HKLM-x32\...\ePubDRMRemoval) (Version: 1.4.1 - eBook Converter)
Free M4a to MP3 Converter 7.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free Studio version 5.9.0.1212 (HKLM-x32\...\Free Studio_is1) (Version: 5.9.0.1212 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.43.806 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.43.806 - DVDVideoSoft Ltd.)
GameCatalog21.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
GameCatalog32.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
Gemalto (Version: 01.64.01.0010 - Wave Systems Corp) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
High-Logic FontCreator 6.5 (HKLM-x32\...\FontCreator6_is1) (Version:  - High-Logic B.V.)
Incredible Worlds Double Pack (HKLM-x32\...\510009534) (Version:  - Oberon Media)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.27.0 (HKLM-x32\...\{F109D156-577D-101B-A622-CF4351943AA4}) (Version: 1.2.27.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections 16.5.2.0 (HKLM\...\PROSetDX) (Version: 16.5.2.0 - Dell)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3040 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kindle DRM Removal (HKLM-x32\...\KindleDRMRemoval) (Version: 1.4.1 - eBook Converter)
Lost Souls - Timeless Fables (HKLM-x32\...\510009657) (Version:  - Oberon Media)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.2 (x86 de)) (Version: 33.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.2 - Notepad++ Team)
NTRU TCG Software Stack (Version: 2.1.36 - Security Innovation, Inc.) Hidden
NVIDIA 3D Vision Treiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 306.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA nView 136.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 136.53 - NVIDIA Corporation)
O2Micro Flash Memory Card Windows Driver (HKLM-x32\...\InstallShield_{0CB3B7EE-52C7-4136-AF40-605567D90318}) (Version: 3.0.07.23 - O2Micro International LTD.)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.0.07.23 - O2Micro International LTD.) Hidden
Oracle VM VirtualBox 4.2.10 (HKLM\...\{E28F112D-4784-4466-AE4B-07B3630C857F}) (Version: 4.2.10 - Oracle Corporation)
PC-CCID (Version: 2.0.0 - Gemalto) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Preboot Manager (Version: 03.03.00.074 - Wave Systems Corp.) Hidden
Private Information Manager (Version: 07.01.00.022 - Wave Systems Corp.) Hidden
Product Key Explorer 3.1.3 (HKLM-x32\...\Product Key Explorer_is1) (Version:  - Nsasoft, LLC.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Reader Library by Sony (HKLM-x32\...\{B70E5793-F912-4C62-AFE2-C4F0B078FD31}) (Version: 3.3.00.07130 - Sony)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SPBA 5.9 (Version: 5.9.4.6686 - UPEK Inc.) Hidden
Tales of Monkey Island (HKLM-x32\...\Tales of Monkey Island) (Version: 3.0.0.0 - Daedalic Entertainment)
Trusted Drive Manager (Version: 4.1.1.312 - Wave Systems Corp.) Hidden
Upek Touchchip Fingerprint Reader (Version: 1.2.004 - Dell Inc.) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wave Infrastructure Installer (Version: 07.67.17.0010 - Wave Systems Corp) Hidden
Wave Support Software Installer (Version: 05.13.00.033 - Wave Systems Corp) Hidden
WD Drive Utilities (HKLM-x32\...\{2D2BD030-2DC0-478F-9710-3554FFC0D797}) (Version: 1.0.7.3 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{B7063C41-A5D1-482D-BE07-34750B26950B}) (Version: 2.1.0.11 - Western Digital Technologies, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (HKLM\...\9512AA21B791B05A54E27065C45BBC417AB282DF) (Version: 09/11/2009 1.0.1.6 - Dell Inc.)
Zune (HKLM\...\Zune) (Version: 04.08.2345.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

16-10-2014 05:39:58 Dell Updates
16-10-2014 06:16:05 Windows Update
19-10-2014 18:30:14 Windows Update
24-10-2014 19:43:35 Windows Update
28-10-2014 19:30:18 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-12-11 11:45 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0D5B5C33-BF55-4405-AF6B-9B9B2F96FFDF} - System32\Tasks\Dell\Command Update => C:\Program Files (x86)\Dell\CommandUpdate\DellCommandUpdate.exe [2014-05-05] (Dell Inc.)
Task: {114FC741-9B27-47C3-9ED2-47F49B05D0E7} - System32\Tasks\{663BB892-4617-4AAA-80FF-9CE6AB2EF84B} => D:\SETUP.EXE
Task: {3B3F041A-FBAD-4FA5-8E80-3058867E388F} - System32\Tasks\{A7811205-CFFE-4128-A888-06213E056FA9} => D:\SETUP.EXE
Task: {43C15320-82CE-4EE8-8D1E-85A4A0A895C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-16] (Adobe Systems Incorporated)
Task: {4BF51701-F960-4733-A460-5D59D7D1BF60} - System32\Tasks\{4FCB3C49-EC9A-42AE-955A-2660C771F716} => D:\SETUP.EXE
Task: {6DA8F52E-B150-4485-AC34-0EFF1ACD2EF9} - System32\Tasks\{47ED87FF-0DE0-4BF6-AA69-E0A9DA1F22B5} => D:\SETUP.EXE
Task: {70D7B408-C8CE-4C44-B35F-322796755FC5} - System32\Tasks\Western Digital\SmartWare\____Volume_c2befd37_4105_11e1_814f_806e6f6e6963______Volume_03d5da04_e37b_11e3_9737_806e6f6e6963__ => C:\Program Files (x86)\Western Digital\WD SmartWare\BackupTask.exe [2013-06-19] (Western Digital Technologies, Inc.)
Task: {763CD2A9-4CE9-4F8A-85D2-B22F4162EDF3} - System32\Tasks\{4C263F9F-6591-4176-A528-7A43E0982B21} => D:\SETUP.EXE
Task: {81D19C03-FD1A-4150-A557-4D27C1A5D378} - System32\Tasks\{940BD94B-3269-4761-A0FB-B983B98A2045} => D:\SETUP.EXE
Task: {8BC414D6-566A-4EC5-9D8E-274581059BB7} - System32\Tasks\{8CB751C0-FFB0-42CC-B28A-30393C059C63} => D:\SETUP.EXE
Task: {912C4EF3-C2DB-4BC2-9DFB-5FC97B89C0F3} - System32\Tasks\{C14A32B9-BA4A-43AD-8B71-AFD967ED9CC1} => D:\SETUP.EXE
Task: {A2AFDEC9-90E8-4A3A-A889-0E27A7D91A1F} - System32\Tasks\{A0D6453B-6605-4745-9EE1-4CC2517D1D74} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {A794C86B-E2FD-4ADD-BAED-77CAE988746C} - System32\Tasks\{40095177-C9DC-4551-8F92-11A2707DB678} => D:\SETUP.EXE
Task: {B0E6EF93-DA75-42E7-88A4-E79A748E04DA} - System32\Tasks\{BEC3D6AC-7C9A-4CE1-AAC3-33E212D75251} => D:\SETUP.EXE
Task: {B4E59951-ED1F-4B92-B88B-561A7D1CEC44} - System32\Tasks\AdobeAAMUpdater-1.0-Wulli-Constanze => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-01-24] (Adobe Systems Incorporated)
Task: {C2F82158-E617-4FC6-B3A3-F1D7426370C6} - System32\Tasks\{F09AB0D1-E6C1-4052-B95C-5BDD54229614} => D:\SETUP.EXE
Task: {C4AFF9BD-4EAE-4AE8-BB63-E5C11B4CB061} - System32\Tasks\{2744E3A0-78AC-4250-BE65-9E60B92308B6} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {CD5DBC02-859F-4C2A-B471-44E6D3FE2319} - System32\Tasks\{66EC3D49-3FAF-4BD7-BFC3-275842B25861} => D:\SETUP.EXE
Task: {CFECC2D4-1AF3-4F3D-9ACA-5CF8CDC3156A} - System32\Tasks\{BE9068AA-3BD0-4090-B0F1-A6DA4ECF6E40} => D:\SETUP.EXE
Task: {D7658736-0F71-4E6F-BB5F-4AC63C1FC9E1} - System32\Tasks\{ABB68144-B87A-424A-9633-21CA29D080D4} => D:\SETUP.EXE
Task: {DE7D347C-6DB5-4C96-84F0-807527BFC0B5} - System32\Tasks\{5AAFE2D1-5A6E-4EE1-B573-B952C3363EBE} => D:\SETUP.EXE
Task: {E9DC5837-283F-4BDD-9E60-4FB5295583B0} - System32\Tasks\{B5382562-EFCB-4992-9715-2AB036EA833F} => D:\SETUP.EXE
Task: {ED9B950E-BF5C-4659-B621-714280868F9B} - System32\Tasks\{FC0195C6-64AF-4E53-99BE-E481706A9022} => D:\SETUP.EXE
Task: {FAC722AA-8578-479E-84DE-EF32AF6F9807} - System32\Tasks\{A56937AB-F66A-469E-A556-B67BD0AE0C15} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-01-03 12:39 - 2012-10-02 20:51 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-01-17 20:53 - 2003-04-19 03:06 - 00008192 ____N () c:\Windows\SysWOW64\srvany.exe
2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2012-01-17 13:24 - 2012-10-08 11:42 - 00380776 _____ () C:\Program Files\NVIDIA Corporation\nview\nvshell.dll
2012-01-17 22:07 - 2011-06-10 19:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-01-17 20:51 - 2012-09-05 11:51 - 00686744 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2012-07-01 20:10 - 2010-03-16 00:18 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2012-07-01 20:10 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2010-07-13 00:28 - 2010-07-13 00:28 - 00856064 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\fsk.dll
2010-07-13 00:13 - 2010-07-13 00:13 - 00033792 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMediaPlayers.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00233472 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\Fskin.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00020480 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskinLocalize.dll
2010-04-02 20:23 - 2010-04-02 20:23 - 00815104 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskSecurity.dll
2010-07-13 00:16 - 2010-07-13 00:16 - 00118784 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskDocumentViewer.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00009728 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskPower.dll
2010-07-13 00:26 - 2010-07-13 00:26 - 00018432 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskNetInterface.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00010240 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMobileMediaDevice.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00008704 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00028160 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ticket.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00011776 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll
2010-04-02 19:44 - 2010-04-02 19:44 - 00086016 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookUsb.dll
2010-07-13 00:29 - 2010-07-13 00:29 - 00143360 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\connectionDetector.dll
2010-07-13 00:10 - 2010-07-13 00:10 - 00172032 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\USBDetector.dll
2013-09-03 14:54 - 2013-09-03 14:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\acrotray.deu
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-09-03 14:54 - 2013-09-03 14:54 - 02897280 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\PDFMaker\Common\AdobePDFMakerX.dll
2013-09-03 14:54 - 2013-09-03 14:54 - 01446400 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\PDFMaker\AdobePDFMakerX.DEU
2013-02-14 15:46 - 2013-02-14 15:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2014-10-31 21:46 - 2014-10-31 21:46 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-03 14:54 - 2013-09-03 14:54 - 00105984 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_de\PDFMaker\PDFMOfficeAddin.DEU

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:0EFEBFCB
AlternateDataStreams: C:\ProgramData\Temp:214562D2
AlternateDataStreams: C:\ProgramData\Temp:215C73EE
AlternateDataStreams: C:\ProgramData\Temp:2307DBD5
AlternateDataStreams: C:\ProgramData\Temp:3DBF3B08
AlternateDataStreams: C:\ProgramData\Temp:49B71832
AlternateDataStreams: C:\ProgramData\Temp:6126E9A8
AlternateDataStreams: C:\ProgramData\Temp:C91E924C
AlternateDataStreams: C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

========================= Accounts: ==========================

Administrator (S-1-5-21-3530594910-3682233180-4012714100-500 - Administrator - Disabled)
Constanze (S-1-5-21-3530594910-3682233180-4012714100-1001 - Administrator - Enabled) => C:\Users\Constanze
Gast (S-1-5-21-3530594910-3682233180-4012714100-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3530594910-3682233180-4012714100-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3530594910-3682233180-4012714100-1000 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/01/2014 09:12:55 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (11/01/2014 06:20:01 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (11/01/2014 06:15:07 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/31/2014 08:45:24 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/31/2014 08:45:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/31/2014 08:45:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/31/2014 08:45:13 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (10/31/2014 08:42:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (10/31/2014 08:42:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/31/2014 08:42:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (10/31/2014 08:26:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (10/31/2014 08:26:06 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (10/31/2014 08:23:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NTRU TSS v1.2.1.36 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%0

Error: (10/28/2014 08:26:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (10/28/2014 08:26:28 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (10/28/2014 08:23:46 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NTRU TSS v1.2.1.36 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%0


Microsoft Office Sessions:
=========================
Error: (11/01/2014 09:12:55 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Constanze\Desktop\esetsmartinstaller_deu.exe

Error: (11/01/2014 06:20:01 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Constanze\Desktop\esetsmartinstaller_deu.exe

Error: (11/01/2014 06:15:07 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (10/31/2014 08:45:24 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Constanze\Downloads\esetsmartinstaller_deu.exe

Error: (10/31/2014 08:45:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Constanze\Downloads\esetsmartinstaller_deu.exe

Error: (10/31/2014 08:45:16 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Constanze\Downloads\esetsmartinstaller_deu.exe

Error: (10/31/2014 08:45:13 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Constanze\Downloads\esetsmartinstaller_deu.exe

Error: (10/31/2014 08:42:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (10/31/2014 08:42:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/31/2014 08:42:07 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


CodeIntegrity Errors:
===================================
  Date: 2012-12-11 11:44:57.909
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-12-11 11:44:57.894
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 35%
Total physical RAM: 8073.02 MB
Available physical RAM: 5189.49 MB
Total Pagefile: 16144.21 MB
Available Pagefile: 13064.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:219.2 GB) (Free:54.61 GB) NTFS
Drive e: (My Book) (Fixed) (Total:1862.98 GB) (Free:1287.15 GB) NTFS
Drive f: (LaCie) (Fixed) (Total:931.51 GB) (Free:578.24 GB) NTFS
Drive g: (Lexar) (Removable) (Total:7.45 GB) (Free:7.37 GB) FAT32
Drive h: (Lexar) (Removable) (Total:7.45 GB) (Free:7.19 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 7F8BABDA)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=13.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=219.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: EE0538F2)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: D0C07B02)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 7.5 GB) (Disk ID: A0A99830)
Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0B)

========================================================
Disk: 4 (Size: 7.5 GB) (Disk ID: 9B51CBF8)
Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0B)

==================== End Of Log ============================
         

Dann hatte ich den Rechner über Nacht angelassen und als ich heute Morgen kam, hatte Mbam einen Suchlauf durchgeführt. (Eigentlich habe ich immer nur einen Virenscanner an, aber offenbar hatte ich Mbam nicht richtig aus gemacht. Ich schaue gleich mal, wieso das noch an war.)
Ich habe das Mbam-Protokoll exportiert, das zeigt Null Fehler an, aber der Bildschirm zeigte: "3 Non-Malware Elemente erkannt". Leider habe ich keinen Platz im Netz, so dass ich Dir keinen Screenshot per URL schicken kann, also abtippen. Soll ich die 3 Dinger in Quarantäne stecken?

ELEMENT:  PUP.Optional.QuickStartA, TYP: Datei, PFAD: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\prefs.js
ELEMENT:  PUP.Optional.FastStartA, TYP: Registrierungswert, HKU\S-1-5-21-3530594910-3682233180-4012714100-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid
ELEMENT:  PUP.Optional.FastStartA, TYP: Registrierungsschlüssel, HKU\S-1-5-21-3530594910-3682233180-4012714100-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS
         

Grüße :-)
sparkle

Malwarebytes deinstallieren.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\ProgramData\Malwarebytes
C:\Windows\SysWOW64\srvany.exe
FF NewTab: chrome://quick_start/content/index.html
R2 O2SDIOAssist; c:\Windows\SysWOW64\srvany.exe [8192 2003-04-19] () [File not signed]
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Frisches FRST log bitte.

Hallo Schrauber,

Mbam deinstalliert, mit FRST gefixed und geloggt. Hier kommen die drei Dateien:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-11-2014
Ran by Constanze at 2014-11-03 19:53:34 Run:5
Running from C:\Users\Constanze\Desktop
Loaded Profile: Constanze (Available profiles: UpdatusUser & Constanze)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\ProgramData\Malwarebytes
C:\Windows\SysWOW64\srvany.exe
FF NewTab: chrome://quick_start/content/index.html
R2 O2SDIOAssist; c:\Windows\SysWOW64\srvany.exe [8192 2003-04-19] () [File not signed]
Emptytemp:
*****************

C:\ProgramData\Malwarebytes => Moved successfully.
C:\Windows\SysWOW64\srvany.exe => Moved successfully.
Firefox newtab deleted successfully.
O2SDIOAssist => Service stopped successfully.
O2SDIOAssist => Service deleted successfully.
EmptyTemp: => Removed 3.4 GB temporary data.


The system needed a reboot. 

==== End of Fixlog ====
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-11-2014
Ran by Constanze (administrator) on WULLI on 03-11-2014 21:04:27
Running from C:\Users\Constanze\Desktop
Loaded Profile: Constanze (Available profiles: UpdatusUser & Constanze)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe
(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Dell Inc.) C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Apple Inc.) C:\Program Files (x86)\QuickTime\QTTask.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [DFEPApplication] => C:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe [7077432 2012-08-15] (Dell Inc.)
HKLM\...\Run: [TdmNotify] => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe [257392 2011-05-28] (Wave Systems Corp.)
HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [477600 2013-01-24] (Adobe Systems Incorporated)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2041192 2012-10-08] ()
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686744 2012-09-05] ()
HKLM\...\Run: [Onboard] => C:\Program Files\Western Digital\WD SmartWare\WDSmartWare.exe [3164536 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112408 2011-08-09] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [462993 2010-03-12] (Creative Technology Ltd)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Reader Library Launcher] => C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5524336 2013-06-19] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll (UPEK Inc.)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: ,C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AkrutoSync.lnk
ShortcutTarget: AkrutoSync.lnk -> C:\Program Files\Akruto\AkrutoSync.exe (Akruto)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smart Settings.lnk
ShortcutTarget: Smart Settings.lnk -> C:\Program Files\Dell\Feature Enhancement Pack\SmartSettings.exe (Dell Inc.)
ShellIconOverlayIdentifiers: [EnabledUnlockedFDEIconOverlay] -> {30D3C2AF-9709-4D05-9CF4-13335F3C1E4A} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)
ShellIconOverlayIdentifiers: [UninitializedFdeIconOverlay] -> {CF08DA3E-C97D-4891-A66B-E39B28DD270F} => C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll (Wave Systems Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3530594910-3682233180-4012714100-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {A9F37828-A92C-477B-98B6-04329E3B861F} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.38 -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @sony.com/eBookLibrary -> C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll (Adobe Systems)
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\abs@avira.com [2014-09-30]
FF Extension: FoxyProxy Standard - C:\Users\Constanze\AppData\Roaming\Mozilla\Firefox\Profiles\8rw89n0f.default\Extensions\foxyproxy@eric.h.jung [2014-09-07]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012-09-23]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DFEPService; c:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe [2280504 2012-08-15] (Dell Inc.)
S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2010-04-02] (Sony Corporation) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S2 tcsd_win32.exe; C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1633280 2011-02-17] () [File not signed]
R2 Wave Authentication Manager Service; C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [1600000 2011-07-01] (Wave Systems Corp.) [File not signed]
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2013-06-19] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [270704 2013-11-20] (Western Digital Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-29] (Avira Operations GmbH & Co. KG)
S3 HBtnKey; C:\Windows\system32\drivers\HBtnKey.sys [20424 2011-07-19] (Dell Inc.)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-03-15] (Oracle Corporation)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-03 21:04 - 2014-11-03 21:05 - 00021954 _____ () C:\Users\Constanze\Desktop\FRST.txt
2014-11-02 21:34 - 2014-11-02 21:34 - 00457456 _____ (Oberon Media Inc.) C:\Users\Constanze\Downloads\thecursedislandmaskofbaragus-510009686-setup.s510009686.c110341560.len.u13e67e4d26f82d9aeb281b7c679a4628e92eebd1.dl.exe
2014-11-02 13:02 - 2014-11-02 13:02 - 00088884 _____ () C:\Users\Constanze\Desktop\texte an Schrauber2015-11-02.txt
2014-11-02 12:15 - 2014-11-02 12:15 - 00041832 _____ () C:\Users\Constanze\Desktop\Addition_2014-11-02.txt
2014-11-02 12:14 - 2014-11-02 12:48 - 00045631 _____ () C:\Users\Constanze\Desktop\FRST_2014-11-02.txt
2014-11-02 11:48 - 2014-11-02 11:48 - 00001223 _____ () C:\Users\Constanze\Desktop\mbam-Meldung-2014-11-02.txt
2014-11-01 23:34 - 2014-11-01 23:34 - 00875013 _____ () C:\Users\Constanze\Downloads\pg1260-images.epub
2014-11-01 21:10 - 2014-11-03 19:53 - 00000000 ____D () C:\Users\Constanze\Desktop\FRST-OlderVersion
2014-11-01 08:41 - 2014-11-01 08:41 - 00000853 _____ () C:\Users\Constanze\Desktop\checkup.txt
2014-10-31 21:46 - 2014-10-31 21:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-31 20:44 - 2014-10-31 20:44 - 02347384 _____ (ESET) C:\Users\Constanze\Desktop\esetsmartinstaller_deu.exe
2014-10-31 20:44 - 2014-10-31 20:44 - 00854448 _____ () C:\Users\Constanze\Desktop\SecurityCheck.exe
2014-10-27 21:39 - 2014-10-27 21:41 - 00000000 ____D () C:\Users\Constanze\Desktop\Etiketten für dei Arbeit
2014-10-27 21:16 - 2014-10-27 21:16 - 00027998 _____ () C:\Users\Constanze\Desktop\Addition_2014-10-27.txt
2014-10-27 21:14 - 2014-11-01 21:12 - 00045058 _____ () C:\Users\Constanze\Desktop\FRST_2014-10-27.txt
2014-10-27 21:07 - 2014-10-27 21:14 - 00001982 _____ () C:\Users\Constanze\Desktop\JRT.txt
2014-10-27 20:46 - 2014-10-27 20:46 - 00004911 _____ () C:\Users\Constanze\Desktop\AdwCleaner[S1].txt
2014-10-27 19:19 - 2014-10-27 19:19 - 01706144 _____ (Thisisu) C:\Users\Constanze\Desktop\JRT.exe
2014-10-27 19:18 - 2014-10-27 19:18 - 01998336 _____ () C:\Users\Constanze\Desktop\AdwCleaner_4.002.exe
2014-10-26 21:11 - 2014-10-26 21:43 - 00063316 _____ () C:\Users\Constanze\Desktop\AVSCAN-20141024-220424-4503797A.LOG
2014-10-26 20:36 - 2014-10-26 20:36 - 00032890 _____ () C:\Users\Constanze\Desktop\Gmer.txt
2014-10-26 19:47 - 2014-10-26 19:48 - 00036042 _____ () C:\Users\Constanze\Desktop\Addition26.10.2014.txt
2014-10-26 19:46 - 2014-10-26 19:48 - 00046401 _____ () C:\Users\Constanze\Desktop\FRST26.10.2014.txt
2014-10-26 19:44 - 2014-10-26 19:44 - 00000480 _____ () C:\Users\Constanze\Desktop\defogger_disable.log
2014-10-26 19:31 - 2014-10-26 19:31 - 00380416 _____ () C:\Users\Constanze\Desktop\Gmer-19357.exe
2014-10-26 19:30 - 2014-11-03 19:53 - 02114560 _____ (Farbar) C:\Users\Constanze\Desktop\FRST64.exe
2014-10-26 19:29 - 2014-10-26 19:29 - 00050477 _____ () C:\Users\Constanze\Desktop\Defogger.exe
2014-10-24 22:02 - 2014-10-24 22:02 - 00020802 _____ () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite.xht
2014-10-24 22:02 - 2014-10-24 22:02 - 00000000 ____D () C:\Users\Constanze\Downloads\Mozilla Firefox-Startseite-Dateien
2014-10-24 21:02 - 2014-10-24 21:02 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\BandExtend
2014-10-24 14:48 - 2014-10-24 14:48 - 00000000 ____D () C:\Users\Constanze\Downloads\Archiv
2014-10-24 14:45 - 2014-10-24 14:47 - 01123346 _____ () C:\Users\Constanze\Downloads\WordCreatorWin.zip
2014-10-23 20:45 - 2014-10-23 20:45 - 00001099 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Content Viewer.lnk
2014-10-23 20:33 - 2014-10-23 20:33 - 00005632 _____ () C:\Users\Constanze\Documents\Dokument4.zdl
2014-10-23 20:33 - 2014-10-23 20:33 - 00005120 _____ () C:\Users\Constanze\Documents\Dokument3.zdl
2014-10-16 07:05 - 2014-10-16 07:05 - 00000000 ____D () C:\Windows\{B7231620-E76C-4C8E-ADD5-594B1C9FF72F}
2014-10-16 06:38 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 06:38 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 06:38 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 06:38 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 06:38 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 06:38 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 06:38 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 06:38 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 06:38 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 06:38 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 06:38 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 06:38 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 06:38 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 06:38 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 06:38 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 06:38 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 06:38 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 06:38 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 06:38 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 06:38 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 06:38 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 06:38 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 06:38 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 06:38 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 06:38 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 06:38 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 06:38 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 06:38 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 06:38 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 06:38 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 06:38 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 06:38 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 06:38 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 06:38 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 06:38 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 06:38 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 06:38 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 06:38 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 06:38 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 06:38 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 06:38 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 06:38 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 06:37 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 06:37 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 06:37 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 06:37 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 06:37 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 06:37 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 06:37 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 06:37 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 06:37 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 06:37 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 06:36 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 06:36 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-05 21:41 - 2014-10-05 21:41 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Fenomen Games
2014-10-05 21:39 - 2014-10-05 21:40 - 00002299 _____ () C:\Users\Constanze\Desktop\Lost Souls - Timeless Fables.lnk
2014-10-04 22:55 - 2014-10-04 22:55 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Urchin

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-03 21:04 - 2014-02-25 09:40 - 00000000 ____D () C:\FRST
2014-11-03 21:03 - 2012-03-28 17:43 - 00000000 ____D () C:\Users\Constanze\Documents\Outlook-Dateien
2014-11-03 21:00 - 2014-06-19 16:09 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Akruto
2014-11-03 20:57 - 2009-07-14 05:51 - 00184586 _____ () C:\Windows\setupact.log
2014-11-03 20:51 - 2012-01-17 13:24 - 01886952 _____ () C:\Windows\WindowsUpdate.log
2014-11-03 20:21 - 2012-04-26 19:22 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-03 20:03 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-03 20:03 - 2009-07-14 05:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-03 19:56 - 2014-09-12 01:19 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2014-11-03 19:55 - 2012-01-17 13:24 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-11-03 19:55 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-03 18:54 - 2010-11-21 07:50 - 08131532 _____ () C:\Windows\system32\perfh007.dat
2014-11-03 18:54 - 2010-11-21 07:50 - 02534728 _____ () C:\Windows\system32\perfc007.dat
2014-11-03 18:54 - 2009-07-14 06:13 - 00006512 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-03 18:52 - 2014-08-18 19:06 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Adobe
2014-11-03 18:50 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-11-03 18:50 - 2012-01-17 20:30 - 00000000 ____D () C:\Windows\system32\NV
2014-11-03 18:50 - 2010-11-21 04:47 - 00434874 _____ () C:\Windows\PFRO.log
2014-11-03 18:40 - 2014-03-05 19:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-02 15:46 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Anschaffungen
2014-11-02 13:33 - 2012-06-27 18:02 - 00000682 _____ () C:\Windows\BRCALIB.INI
2014-11-01 23:49 - 2013-03-10 21:42 - 00000000 ____D () C:\Users\Constanze\Documents\Calibre Bibliothek
2014-10-28 06:34 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-27 22:01 - 2012-01-17 21:07 - 00000000 ____D () C:\ProgramData\Temp
2014-10-27 19:27 - 2014-03-05 19:29 - 00001067 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-27 19:27 - 2014-02-27 18:24 - 00000000 ____D () C:\AdwCleaner
2014-10-27 19:27 - 2012-05-02 20:48 - 00001162 _____ () C:\Users\Constanze\Desktop\Internet Explorer.lnk
2014-10-27 19:27 - 2012-01-24 21:42 - 00001005 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-26 19:05 - 2014-07-13 16:43 - 00009331 _____ () C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML
2014-10-26 18:42 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Abos Vereine
2014-10-26 18:28 - 2012-03-28 16:13 - 00000000 ____D () C:\Users\Constanze\Documents\Briefe diverse Empfänger
2014-10-24 14:49 - 2014-07-14 19:53 - 02959872 _____ () C:\Users\Constanze\Downloads\WordCreator.exe
2014-10-23 20:45 - 2012-01-17 21:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-10-23 20:44 - 2012-09-23 19:23 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-22 20:58 - 2014-06-28 12:31 - 00000000 ____D () C:\Windows\rescache
2014-10-19 18:32 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-19 18:31 - 2009-07-14 05:45 - 05048656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-19 18:27 - 2014-05-07 23:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 07:30 - 2012-01-24 21:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 07:26 - 2013-08-14 21:44 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 07:16 - 2012-03-29 19:44 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-16 07:05 - 2012-01-24 21:43 - 00000000 ____D () C:\Windows\System32\Tasks\Dell
2014-10-16 07:05 - 2012-01-24 21:42 - 00000000 ____D () C:\Users\Constanze\AppData\Local\Dell
2014-10-16 07:05 - 2012-01-17 20:59 - 00000000 ____D () C:\ProgramData\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2014-10-16 07:05 - 2012-01-17 20:49 - 00000000 ____D () C:\Program Files (x86)\Dell
2014-10-16 06:28 - 2012-04-26 19:22 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 06:28 - 2012-01-17 20:34 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 07:51 - 2013-10-16 20:37 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-15 07:51 - 2013-02-25 20:06 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-15 07:49 - 2012-03-28 14:50 - 00000000 ____D () C:\Users\Constanze\Documents\Adressen
2014-10-14 20:01 - 2013-05-07 18:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-14 20:01 - 2013-03-27 18:54 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-12 22:17 - 2012-07-14 21:53 - 00000000 ____D () C:\Users\Constanze\Documents\ePub DRM Removal
2014-10-06 23:00 - 2013-03-10 21:42 - 00000932 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2014-10-06 23:00 - 2013-03-10 21:42 - 00000000 ____D () C:\Program Files\Calibre2
2014-10-06 22:54 - 2014-01-25 21:28 - 00000000 ____D () C:\Users\Constanze\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Iplay
2014-10-05 21:38 - 2014-01-25 21:28 - 00000000 ____D () C:\Program Files (x86)\Oberon Media SIDR
2014-10-05 20:15 - 2012-09-23 20:06 - 00001456 _____ () C:\Users\Constanze\AppData\Local\Adobe Für Web speichern 13.0 Prefs

Some content of TEMP:
====================
C:\Users\Constanze\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-27 20:11

==================== End Of Log ============================
         

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
Ran by Constanze at 2014-11-03 21:05:23
Running from C:\Users\Constanze\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.10.34 - STMicroelectronics)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.8 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Design Standard (HKLM-x32\...\{0327A4BF-62BF-48BB-8928-B971B749E9E1}) (Version: 6 - Adobe Systems Incorporated)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.4.3 - Adobe Systems, Incorporated)
AkrutoSync 3.2.32 (HKLM\...\{024E90DA-8432-40E9-8B31-3C68D1999A36}) (Version: 3.2.32 - Akruto, Inc.)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
BioAPI Framework (Version: 1.0.2 - Dell Inc.) Hidden
Brother MFL-Pro Suite DCP-9055CDN (HKLM-x32\...\{979742CC-2CBB-49D8-9BEE-C2F7875F5393}) (Version: 1.0.27.0 - Brother Industries, Ltd.)
calibre 64bit (HKLM\...\{7A073C16-B3B5-4913-8457-262B6E17947A}) (Version: 2.5.0 - Kovid Goyal)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.3868 - CDBurnerXP)
Classic Adventures 4-in-1 Bundle (HKLM-x32\...\510007534) (Version:  - Oberon Media)
CNM Codec (HKLM-x32\...\{9725A44A-FBBE-427B-8053-1D5ADD0A85E6}) (Version: 1.00.0000 - C & M International)
Criminal Minds (HKLM-x32\...\510006264) (Version:  - Oberon Media)
Custom (Version: 01.00.00.000 - Wave Systems Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery Manager (HKLM\...\{50B4B603-A4C6-4739-AE96-6C76A0F8A388}) (Version: 1.3.1 - Dell Inc.)
Dell Command | Update (HKLM-x32\...\{EC542D5D-B608-4145-A8F7-749C02BE6D94}) (Version: 2.0.0 - Dell Inc.)
Dell ControlVault Host Components Installer 64 bit (Version: 2.1.6.214 - Broadcom Corporation) Hidden
Dell Data Protection | Access (HKLM-x32\...\{A7D91856-258D-4C87-8041-B170851CE432}) (Version: 2.1.00001.002 - Dell Inc.)
Dell Data Protection | Access (Version: 02.01.01.002 - Wave Systems Corp) Hidden
Dell Data Protection | Access | Drivers (HKLM-x32\...\{4E4E65EE-C456-45AC-B5AD-C62C3A325BD0}) (Version: 2.01.018 - Dell Inc.)
Dell Data Protection | Access | Middleware (HKLM-x32\...\{841CBDD5-4BB5-403E-AEE3-2FADC3890BE8}) (Version: 2.01.010 - Dell Inc.)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Feature Enhancement Pack (HKLM\...\{992D1CE7-A20F-4AB0-9D9D-AFC3418844DA}) (Version: 2.2.1 - Dell)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.134 - ALPS ELECTRIC CO., LTD.)
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.28 - Creative Technology Ltd)
DellAccess (Version: 01.01.00.072 - Wave Systems Corp.) Hidden
DesignPro 5 (x32 Version: 5.5.708 - Avery Dennison) Hidden
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\{D2B31FE6-127F-4E79-8186-F080A282FBC7}) (Version: 1.0.0.46 - Intenium GmbH)
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 5.1.6 - CEWE Stiftung u Co. KGaA)
Dream Aquarium (HKLM-x32\...\DreamAqua) (Version:  - )
Dream Day Wedding Collector Set (HKLM-x32\...\119498770) (Version:  - Oberon Media)
Duden-Bibliothek (HKLM-x32\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.1.0 - Bibliographisches Institut GmbH)
EMBASSY Security Center (Version: 04.03.00.121 - Wave Systems Corp.) Hidden
ePub DRM Removal (HKLM-x32\...\ePubDRMRemoval) (Version: 1.4.1 - eBook Converter)
Free M4a to MP3 Converter 7.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free Studio version 5.9.0.1212 (HKLM-x32\...\Free Studio_is1) (Version: 5.9.0.1212 - DVDVideoSoft Ltd.)
Free YouTube Download version 3.2.43.806 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.43.806 - DVDVideoSoft Ltd.)
GameCatalog21.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
GameCatalog32.2013 (x32 Version: 1.00.0000 - Intenium GmbH) Hidden
Gemalto (Version: 01.64.01.0010 - Wave Systems Corp) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
High-Logic FontCreator 6.5 (HKLM-x32\...\FontCreator6_is1) (Version:  - High-Logic B.V.)
Incredible Worlds Double Pack (HKLM-x32\...\510009534) (Version:  - Oberon Media)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1010 - Intel Corporation)
Intel(R) Identity Protection Technology 1.2.27.0 (HKLM-x32\...\{F109D156-577D-101B-A622-CF4351943AA4}) (Version: 1.2.27.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.70.1205 - Intel Corporation)
Intel(R) Network Connections 16.5.2.0 (HKLM\...\PROSetDX) (Version: 16.5.2.0 - Dell)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3040 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kindle DRM Removal (HKLM-x32\...\KindleDRMRemoval) (Version: 1.4.1 - eBook Converter)
Lost Souls - Timeless Fables (HKLM-x32\...\510009657) (Version:  - Oberon Media)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.2 (x86 de)) (Version: 33.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.2 - Notepad++ Team)
NTRU TCG Software Stack (Version: 2.1.36 - Security Innovation, Inc.) Hidden
NVIDIA 3D Vision Treiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 306.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA nView 136.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 136.53 - NVIDIA Corporation)
O2Micro Flash Memory Card Windows Driver (HKLM-x32\...\InstallShield_{0CB3B7EE-52C7-4136-AF40-605567D90318}) (Version: 3.0.07.23 - O2Micro International LTD.)
O2Micro Flash Memory Card Windows Driver (x32 Version: 3.0.07.23 - O2Micro International LTD.) Hidden
Oracle VM VirtualBox 4.2.10 (HKLM\...\{E28F112D-4784-4466-AE4B-07B3630C857F}) (Version: 4.2.10 - Oracle Corporation)
PC-CCID (Version: 2.0.0 - Gemalto) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Preboot Manager (Version: 03.03.00.074 - Wave Systems Corp.) Hidden
Private Information Manager (Version: 07.01.00.022 - Wave Systems Corp.) Hidden
Product Key Explorer 3.1.3 (HKLM-x32\...\Product Key Explorer_is1) (Version:  - Nsasoft, LLC.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Reader Library by Sony (HKLM-x32\...\{B70E5793-F912-4C62-AFE2-C4F0B078FD31}) (Version: 3.3.00.07130 - Sony)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SPBA 5.9 (Version: 5.9.4.6686 - UPEK Inc.) Hidden
Tales of Monkey Island (HKLM-x32\...\Tales of Monkey Island) (Version: 3.0.0.0 - Daedalic Entertainment)
Trusted Drive Manager (Version: 4.1.1.312 - Wave Systems Corp.) Hidden
Upek Touchchip Fingerprint Reader (Version: 1.2.004 - Dell Inc.) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wave Infrastructure Installer (Version: 07.67.17.0010 - Wave Systems Corp) Hidden
Wave Support Software Installer (Version: 05.13.00.033 - Wave Systems Corp) Hidden
WD Drive Utilities (HKLM-x32\...\{2D2BD030-2DC0-478F-9710-3554FFC0D797}) (Version: 1.0.7.3 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{B7063C41-A5D1-482D-BE07-34750B26950B}) (Version: 2.1.0.11 - Western Digital Technologies, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (HKLM\...\9512AA21B791B05A54E27065C45BBC417AB282DF) (Version: 09/11/2009 1.0.1.6 - Dell Inc.)
Zune (HKLM\...\Zune) (Version: 04.08.2345.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

16-10-2014 05:39:58 Dell Updates
16-10-2014 06:16:05 Windows Update
19-10-2014 18:30:14 Windows Update
24-10-2014 19:43:35 Windows Update
28-10-2014 19:30:18 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-12-11 11:45 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0D5B5C33-BF55-4405-AF6B-9B9B2F96FFDF} - System32\Tasks\Dell\Command Update => C:\Program Files (x86)\Dell\CommandUpdate\DellCommandUpdate.exe [2014-05-05] (Dell Inc.)
Task: {114FC741-9B27-47C3-9ED2-47F49B05D0E7} - System32\Tasks\{663BB892-4617-4AAA-80FF-9CE6AB2EF84B} => D:\SETUP.EXE
Task: {3B3F041A-FBAD-4FA5-8E80-3058867E388F} - System32\Tasks\{A7811205-CFFE-4128-A888-06213E056FA9} => D:\SETUP.EXE
Task: {43C15320-82CE-4EE8-8D1E-85A4A0A895C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-16] (Adobe Systems Incorporated)
Task: {4BF51701-F960-4733-A460-5D59D7D1BF60} - System32\Tasks\{4FCB3C49-EC9A-42AE-955A-2660C771F716} => D:\SETUP.EXE
Task: {6DA8F52E-B150-4485-AC34-0EFF1ACD2EF9} - System32\Tasks\{47ED87FF-0DE0-4BF6-AA69-E0A9DA1F22B5} => D:\SETUP.EXE
Task: {70D7B408-C8CE-4C44-B35F-322796755FC5} - System32\Tasks\Western Digital\SmartWare\____Volume_c2befd37_4105_11e1_814f_806e6f6e6963______Volume_03d5da04_e37b_11e3_9737_806e6f6e6963__ => C:\Program Files (x86)\Western Digital\WD SmartWare\BackupTask.exe [2013-06-19] (Western Digital Technologies, Inc.)
Task: {763CD2A9-4CE9-4F8A-85D2-B22F4162EDF3} - System32\Tasks\{4C263F9F-6591-4176-A528-7A43E0982B21} => D:\SETUP.EXE
Task: {81D19C03-FD1A-4150-A557-4D27C1A5D378} - System32\Tasks\{940BD94B-3269-4761-A0FB-B983B98A2045} => D:\SETUP.EXE
Task: {8BC414D6-566A-4EC5-9D8E-274581059BB7} - System32\Tasks\{8CB751C0-FFB0-42CC-B28A-30393C059C63} => D:\SETUP.EXE
Task: {912C4EF3-C2DB-4BC2-9DFB-5FC97B89C0F3} - System32\Tasks\{C14A32B9-BA4A-43AD-8B71-AFD967ED9CC1} => D:\SETUP.EXE
Task: {A2AFDEC9-90E8-4A3A-A889-0E27A7D91A1F} - System32\Tasks\{A0D6453B-6605-4745-9EE1-4CC2517D1D74} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {A794C86B-E2FD-4ADD-BAED-77CAE988746C} - System32\Tasks\{40095177-C9DC-4551-8F92-11A2707DB678} => D:\SETUP.EXE
Task: {B0E6EF93-DA75-42E7-88A4-E79A748E04DA} - System32\Tasks\{BEC3D6AC-7C9A-4CE1-AAC3-33E212D75251} => D:\SETUP.EXE
Task: {B4E59951-ED1F-4B92-B88B-561A7D1CEC44} - System32\Tasks\AdobeAAMUpdater-1.0-Wulli-Constanze => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-01-24] (Adobe Systems Incorporated)
Task: {C2F82158-E617-4FC6-B3A3-F1D7426370C6} - System32\Tasks\{F09AB0D1-E6C1-4052-B95C-5BDD54229614} => D:\SETUP.EXE
Task: {C4AFF9BD-4EAE-4AE8-BB63-E5C11B4CB061} - System32\Tasks\{2744E3A0-78AC-4250-BE65-9E60B92308B6} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: {CD5DBC02-859F-4C2A-B471-44E6D3FE2319} - System32\Tasks\{66EC3D49-3FAF-4BD7-BFC3-275842B25861} => D:\SETUP.EXE
Task: {CFECC2D4-1AF3-4F3D-9ACA-5CF8CDC3156A} - System32\Tasks\{BE9068AA-3BD0-4090-B0F1-A6DA4ECF6E40} => D:\SETUP.EXE
Task: {D7658736-0F71-4E6F-BB5F-4AC63C1FC9E1} - System32\Tasks\{ABB68144-B87A-424A-9633-21CA29D080D4} => D:\SETUP.EXE
Task: {DE7D347C-6DB5-4C96-84F0-807527BFC0B5} - System32\Tasks\{5AAFE2D1-5A6E-4EE1-B573-B952C3363EBE} => D:\SETUP.EXE
Task: {E9DC5837-283F-4BDD-9E60-4FB5295583B0} - System32\Tasks\{B5382562-EFCB-4992-9715-2AB036EA833F} => D:\SETUP.EXE
Task: {ED9B950E-BF5C-4659-B621-714280868F9B} - System32\Tasks\{FC0195C6-64AF-4E53-99BE-E481706A9022} => D:\SETUP.EXE
Task: {FAC722AA-8578-479E-84DE-EF32AF6F9807} - System32\Tasks\{A56937AB-F66A-469E-A556-B67BD0AE0C15} => C:\Program Files (x86)\Braingame\Informaticus\Spiel\Informaticus.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-01-03 12:39 - 2012-10-02 20:51 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2012-01-17 22:07 - 2011-06-10 19:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-01-17 20:51 - 2012-09-05 11:51 - 00686744 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2012-07-01 20:10 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2010-07-13 00:28 - 2010-07-13 00:28 - 00856064 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\fsk.dll
2010-07-13 00:13 - 2010-07-13 00:13 - 00033792 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMediaPlayers.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00233472 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\Fskin.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00020480 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskinLocalize.dll
2010-04-02 20:23 - 2010-04-02 20:23 - 00815104 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskSecurity.dll
2010-07-13 00:16 - 2010-07-13 00:16 - 00118784 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskDocumentViewer.dll
2010-07-13 00:22 - 2010-07-13 00:22 - 00009728 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskPower.dll
2010-07-13 00:26 - 2010-07-13 00:26 - 00018432 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskNetInterface.dll
2010-07-13 00:15 - 2010-07-13 00:15 - 00010240 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\FskMobileMediaDevice.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00008704 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\FskTimeHardware.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00028160 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ticket.dll
2010-07-13 00:25 - 2010-07-13 00:25 - 00011776 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookDeviceNotifier.dll
2010-04-02 19:44 - 2010-04-02 19:44 - 00086016 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\ebookUsb.dll
2010-07-13 00:29 - 2010-07-13 00:29 - 00143360 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\connectionDetector.dll
2010-07-13 00:10 - 2010-07-13 00:10 - 00172032 _____ () C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\USBDetector.dll
2013-09-03 14:54 - 2013-09-03 14:54 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\acrotray.deu
2014-10-31 21:46 - 2014-10-31 21:46 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-10-16 06:28 - 2014-10-16 06:28 - 16832176 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:0EFEBFCB
AlternateDataStreams: C:\ProgramData\Temp:214562D2
AlternateDataStreams: C:\ProgramData\Temp:215C73EE
AlternateDataStreams: C:\ProgramData\Temp:2307DBD5
AlternateDataStreams: C:\ProgramData\Temp:3DBF3B08
AlternateDataStreams: C:\ProgramData\Temp:49B71832
AlternateDataStreams: C:\ProgramData\Temp:6126E9A8
AlternateDataStreams: C:\ProgramData\Temp:C91E924C
AlternateDataStreams: C:\Users\Constanze\AppData\Roaming\Microsoft Excel 97-2003.EML:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

========================= Accounts: ==========================

Administrator (S-1-5-21-3530594910-3682233180-4012714100-500 - Administrator - Disabled)
Constanze (S-1-5-21-3530594910-3682233180-4012714100-1001 - Administrator - Enabled) => C:\Users\Constanze
Gast (S-1-5-21-3530594910-3682233180-4012714100-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3530594910-3682233180-4012714100-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3530594910-3682233180-4012714100-1000 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/03/2014 08:58:13 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (11/03/2014 08:58:05 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelQosEventCIntelQosEvent//./root/default

Error: (11/03/2014 08:58:05 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelDot1xEventCIntelDot1xEvent//./root/default

Error: (11/03/2014 08:58:05 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelWLANEventCIntelWLANEvent//./root/default

Error: (11/03/2014 07:57:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/03/2014 06:54:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (11/03/2014 06:54:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/03/2014 06:54:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/03/2014 06:51:58 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelQosEventCIntelQosEvent//./root/default

Error: (11/03/2014 06:51:58 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelDot1xEventCIntelDot1xEvent//./root/default


System errors:
=============
Error: (11/03/2014 07:58:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (11/03/2014 07:58:29 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (11/03/2014 07:55:44 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NTRU TSS v1.2.1.36 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%0

Error: (11/03/2014 06:54:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (11/03/2014 06:54:58 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (11/03/2014 06:51:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (11/03/2014 06:50:25 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NTRU TSS v1.2.1.36 TCS" ist vom Dienst "TPM-Basisdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%0

Error: (11/03/2014 06:50:24 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎03.‎11.‎2014 um 18:48:21 unerwartet heruntergefahren.

Error: (11/03/2014 06:43:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (11/03/2014 06:43:35 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).


Microsoft Office Sessions:
=========================
Error: (11/03/2014 08:58:13 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Constanze\Desktop\esetsmartinstaller_deu.exe

Error: (11/03/2014 08:58:05 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelQosEventCIntelQosEvent//./root/default

Error: (11/03/2014 08:58:05 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelDot1xEventCIntelDot1xEvent//./root/default

Error: (11/03/2014 08:58:05 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelWLANEventCIntelWLANEvent//./root/default

Error: (11/03/2014 07:57:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/03/2014 06:54:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (11/03/2014 06:54:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/03/2014 06:54:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/03/2014 06:51:58 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelQosEventCIntelQosEvent//./root/default

Error: (11/03/2014 06:51:58 PM) (Source: WinMgmt) (EventID: 24) (User: )
Description: IntelWLANEventProviderselect * from CIntelDot1xEventCIntelDot1xEvent//./root/default


CodeIntegrity Errors:
===================================
  Date: 2012-12-11 11:44:57.909
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-12-11 11:44:57.894
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
Percentage of memory in use: 24%
Total physical RAM: 8073.02 MB
Available physical RAM: 6085.57 MB
Total Pagefile: 16144.21 MB
Available Pagefile: 13292.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:219.2 GB) (Free:58.2 GB) NTFS
Drive e: (My Book) (Fixed) (Total:1862.98 GB) (Free:1285.02 GB) NTFS
Drive f: (LaCie) (Fixed) (Total:931.51 GB) (Free:576.09 GB) NTFS
Drive h: (Lexar) (Removable) (Total:7.45 GB) (Free:7.19 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 7F8BABDA)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=13.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=219.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 9B51CBF8)
Partition 1: (Not Active) - (Size=7.5 GB) - (Type=0B)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: D0C07B02)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: EE0538F2)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Grüße
sparkle