Beim Versenden einer Mail mit Firefox ist mir jetzt zum dritten mal aufgefallen, daß irgendein Anhang mitgeschickt werden soll. Ich selbst hatte keinen Anhang mitschicken wollen.
Es soll immer ein PNG mit Namen *cdjbdbj.png angehängt werden. z.B. "fcdjbdbj.png".
Das sieht mir stark nach einem Virus aus. Hat schon mal jemand von so einem Anhang gehört?

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hi,

Danke erst mal für die Antwort!

Hier der FRST.txt

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 30-10-2014 01
Ran by Bolle (administrator) on NEILARMSTRONG on 31-10-2014 10:14:28
Running from C:\Users\Bolle\Desktop
Loaded Profile: Bolle (Available profiles: Bolle)
Platform: Microsoft Windows 7 Professional N  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Apache Software Foundation) C:\xampp\apache\bin\httpd.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
() C:\Program Files\Autodesk\3ds Max Design 2013\NVIDIA\raysat_3dsmax2013_32server.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\xampp\mysql\bin\mysqld.exe
() C:\Windows\System32\PSIService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Apache Software Foundation) C:\xampp\apache\bin\httpd.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
() C:\Program Files\GIGABYTE\ET6\GUI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
(Sonic Solutions) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
() C:\Users\Bolle\AppData\Local\WSE_Astromenda\BRS\brs.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\Snagit32.exe
(Dropbox, Inc.) C:\Users\Bolle\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Sonic Solutions) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\TscHelp.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\SnagPriv.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\SnagitEditor.exe
(AIMP DevTeam) C:\Program Files\AIMP3\AIMP3.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\wmi32.exe
(Farbar) C:\Users\Bolle\Desktop\FRST(1).exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10959464 2012-01-16] (Realtek Semiconductor)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM\...\Run: [Ulead AutoDetector v2] => C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe [95504 2007-08-02] (Ulead Systems, Inc.)
HKLM\...\Run: [AVP] => C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-12-05] (Kaspersky Lab ZAO)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [ISUSPM Startup] => C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2006-10-03] (Macrovision Corporation)
HKLM\...\Run: [ISUSScheduler] => C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2006-10-03] (Macrovision Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [RoxWatchTray] => C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [221184 2006-11-05] (Sonic Solutions)
HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [383424 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [1634112 2012-05-31] ()
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\RunOnce: [EasyTuneVI] => C:\Program Files\GIGABYTE\ET6\ETCall.exe [40960 2012-02-01] ()
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\Run: [BRS] => C:\Users\Bolle\AppData\Local\WSE_Astromenda\BRS\brs.exe [1173504 2014-08-12] ()
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\RunOnce: [WSE_Astromenda] => wscript /E:vbscript /B "C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\bkup.dat"
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\Policies\Explorer: [] 
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\Policies\Explorer: [DisallowRun] 1
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-06-29] (Microsoft Corporation)
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snagit 9.lnk
ShortcutTarget: Snagit 9.lnk -> C:\Program Files\TechSmith\Snagit 9\Snagit32.exe (TechSmith Corporation)
Startup: C:\Users\Bolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Bolle\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [Symbol-Overlay-Steuerprogramm für AutoCAD Digitale Signaturen] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCyD0FtDyBzyyCyBtG0E0FtCyBtGzztAtDtDtGyBtC0CyBtGyDyCtCtAtCtAtAyDzy0B0E0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=786703565&ir=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC744E9914BF1CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -  No File
SearchScopes: HKLM - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCyD0FtDyBzyyCyBtG0E0FtCyBtGzztAtDtDtGyBtC0CyBtGyDyCtCtAtCtAtAyDzy0B0E0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=786703565&ir=
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutAtFtDtFtCtDtFtBtN1L1CzutCyEtBzytDyD1V1OtN1L1G1B1V1N2Y1L1Qzu2StCyE0B0EtB0C0C0EtG0A0AzytBtG0ByCzztAtG0D0EtA0EtGyB0DyBtD0CtC0A0CtCzz0FtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=384927249&ir=
SearchScopes: HKCU - DefaultScope {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutAtFtDtFtCtDtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StB0Ezzzy0E0FyBtDtGtCyByD0FtGyDtD0FyCtGtA0B0F0DtGtB0C0A0Czz0FtB0EzyyDyDyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=512529961&ir=
SearchScopes: HKCU - {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutAtFtDtFtCtDtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StB0Ezzzy0E0FyBtDtGtCyByD0FtGyDtD0FyCtGtA0B0F0DtGtB0C0A0Czz0FtB0EzyyDyDyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=512529961&ir=
SearchScopes: HKCU - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCyD0FtDyBzyyCyBtG0E0FtCyBtGzztAtDtDtGyBtC0CyBtGyDyCtCtAtCtAtAyDzy0B0E0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=786703565&ir=
SearchScopes: HKCU - {B065DB9C-E3E7-4086-A300-3635B72078D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV
SearchScopes: HKCU - {DE62F315-7861-4428-9EDC-3D36B94836FD} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLBR1&pc=SPLH
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: No Name -> {84FF7BD6-B47F-46F8-9130-01B2696B36CB} ->  No File
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: mysearchdial Helper Object -> {EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} -> C:\Program Files\Mysearchdial\1.8.21.0\bh\mysearchdial.dll No File
BHO: BonanzaDeals -> {fe063412-bea4-4d76-8ed3-183be6220d17} -> C:\Program Files\BonanzaDeals\BonanzaDealsIE.dll No File
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM - NuSphere Debugger ToolBar - {0F62D223-9206-4EA3-9EA8-D0F3C7C82ACA} - C:\Program Files\NuSphere\PhpED\NuSphereIEBar.dll ()
Toolbar: HKCU - No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} -  No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\..\Interfaces\{A2BCD42D-08DF-4E10-A6FB-344E3B7CDAAB}: [NameServer] 10.4.71.2,10.4.71.66

FireFox:
========
FF ProfilePath: C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default
FF DefaultSearchEngine: Wikipedia (de)
FF SelectedSearchEngine: Wikipedia (de)
FF Homepage: google.de
FF Keyword.URL: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50826.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 -> C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 -> C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Users\Bolle\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\searchplugins\Mysearchdial.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-04-04]
FF Extension: Adblock Plus - C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-04]
FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013-12-05]
FF StartMenuInternet: FIREFOX.EXE - C:\Users\Bolle\Documents\Firefox Browser\App\Firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Users\Bolle\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh [2012-10-25]
CHR HKLM\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Bolle\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-01]
CHR HKLM\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx [2012-10-25]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apache2.2; c:\xampp\apache\bin\httpd.exe [20549 2010-10-18] (Apache Software Foundation) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-12-05] (Kaspersky Lab ZAO)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2013-12-19] (Flexera Software, Inc.)
S3 ICCS; C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 mi-raysat_3dsmax2013_32; C:\Program Files\Autodesk\3ds Max Design 2013\NVIDIA\raysat_3dsmax2013_32server.exe [86016 2011-09-15] () [File not signed]
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe [3004416 2007-11-07] (Microsoft Corporation)
R2 mysql; c:\xampp\mysql\bin\mysqld.exe [8133120 2010-12-03] () [File not signed]
R2 NVWMI; C:\Windows\system32\nvwmi.exe [2058184 2014-03-20] ()
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [174656 2006-11-02] () [File not signed]
S3 RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [880640 2006-11-05] (Sonic Solutions) [File not signed]
S2 RoxWatch9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [159744 2006-11-05] (Sonic Solutions) [File not signed]
S3 stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [73728 2006-09-14] (MicroVision Development, Inc.) [File not signed]
S2 bonanzadealslive; C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe /svc [X]
S3 bonanzadealslivem; C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [19056 2011-11-02] ()
R3 CBUSB; C:\Windows\System32\drivers\CBUSB.sys [45056 2013-12-05] (MARX CryptoTech LP)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-08-12] (Disc Soft Ltd)
R3 gdrv; C:\Windows\gdrv.sys [17488 2014-10-31] (Windows (R) 2000 DDK provider)
R3 GVTDrv; C:\Windows\system32\Drivers\GVTDrv.sys [24944 2014-10-31] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2013-12-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [597600 2014-05-20] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-12-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25696 2013-12-05] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-12-05] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [44000 2013-12-05] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145040 2013-12-05] (Kaspersky Lab ZAO)
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [36528 2006-07-24] (Sonic Solutions) [File not signed]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [74848 2014-05-20] (Kaspersky Lab ZAO)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-31 10:14 - 2014-10-31 10:14 - 00022631 _____ () C:\Users\Bolle\Desktop\FRST.txt
2014-10-31 10:13 - 2014-10-31 10:12 - 01105408 _____ (Farbar) C:\Users\Bolle\Desktop\FRST(1).exe
2014-10-31 10:12 - 2014-10-31 10:12 - 01105408 _____ (Farbar) C:\Users\Bolle\Downloads\FRST(1).exe
2014-10-31 10:07 - 2014-10-31 10:07 - 00262144 _____ () C:\Windows\system32\config\elam
2014-10-30 18:21 - 2014-10-30 19:39 - 00040290 _____ () C:\Users\Bolle\Documents\P016001.dwg
2014-10-30 18:09 - 2014-10-30 18:09 - 00003701 _____ () C:\Users\Bolle\Documents\P016001.DXF
2014-10-29 14:42 - 2014-10-29 14:42 - 00001849 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-10-29 14:42 - 2014-10-29 14:42 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Canneverbe Limited
2014-10-29 14:42 - 2014-10-29 14:42 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-10-29 14:42 - 2014-10-29 14:42 - 00000000 ____D () C:\Program Files\CDBurnerXP
2014-10-29 06:45 - 2014-10-29 06:45 - 00210336 _____ () C:\Windows\Minidump\102914-10732-01.dmp
2014-10-28 20:42 - 2014-10-28 20:42 - 06126536 _____ (Tim Kosse) C:\Users\Bolle\Downloads\FileZilla_3.9.0.6_win32-setup.exe
2014-10-28 11:07 - 2014-10-28 11:08 - 10575872 _____ () C:\Users\Bolle\Documents\Database3.accdb
2014-10-27 12:35 - 2014-10-27 12:35 - 00171992 _____ () C:\Windows\Minidump\102714-11185-01.dmp
2014-10-22 09:25 - 2014-10-22 09:25 - 00054074 _____ () C:\Users\Bolle\Documents\Playlist_24.aimppl
2014-10-21 09:55 - 2014-10-21 16:22 - 00051618 _____ () C:\Users\Bolle\Documents\Playlist_23.aimppl
2014-10-20 13:51 - 2014-10-20 13:52 - 00344064 _____ () C:\Users\Bolle\Documents\Database2.accdb
2014-10-16 07:43 - 2014-10-16 07:43 - 00203559 _____ () C:\cranim_50.lsp
2014-10-16 07:42 - 2014-10-16 07:42 - 00143456 _____ () C:\cm_rec_50.lsp
2014-10-15 05:08 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 05:08 - 2014-09-29 01:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 05:08 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 05:08 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 05:08 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 05:08 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 05:08 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 05:08 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 05:08 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 05:08 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 05:08 - 2014-09-19 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 05:08 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 05:08 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 05:08 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 05:08 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 05:08 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 05:08 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 05:08 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 05:08 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 05:08 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 05:08 - 2014-09-19 01:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 05:08 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 05:08 - 2014-09-19 01:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 05:08 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 05:08 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 05:08 - 2014-09-19 01:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 05:08 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 05:08 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 05:08 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 05:08 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 05:08 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 05:08 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 05:08 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 05:08 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 05:08 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-15 05:08 - 2014-07-17 02:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 05:08 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 05:08 - 2014-07-17 02:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 05:08 - 2014-07-17 02:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 05:08 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 05:08 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 05:08 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-09 12:47 - 2014-10-09 12:51 - 01122304 _____ () C:\Users\Bolle\Documents\Database1.accdb
2014-10-09 12:05 - 2014-10-09 12:05 - 00000000 _____ () C:\Users\Bolle\Documents\ini.txt
2014-10-09 09:59 - 2014-10-09 09:59 - 01357360 _____ (Microsoft Corporation) C:\Users\Bolle\Downloads\Jet35sp3.exe
2014-10-01 05:36 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-31 10:14 - 2014-08-19 16:15 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\AIMP3
2014-10-31 10:14 - 2014-02-07 20:06 - 00000000 ____D () C:\FRST
2014-10-31 10:13 - 2013-12-05 11:38 - 00000000 ____D () C:\mcpqt63o.default
2014-10-31 10:09 - 2013-12-05 11:08 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-10-31 09:55 - 2013-12-05 01:55 - 00000292 _____ () C:\Windows\Tasks\MySearchDial.job
2014-10-31 09:52 - 2013-12-05 11:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-31 09:34 - 2014-08-12 10:24 - 00000292 _____ () C:\Windows\Tasks\WSE_Astromenda.job
2014-10-31 09:34 - 2013-12-19 05:55 - 00000173 _____ () C:\Users\Bolle\AppData\Roaming\WB.CFG
2014-10-31 06:30 - 2009-07-14 05:02 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-31 06:30 - 2009-07-14 05:02 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-31 06:28 - 2013-12-05 00:22 - 01805396 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-31 06:26 - 2013-12-05 00:19 - 02014763 _____ () C:\Windows\WindowsUpdate.log
2014-10-31 06:23 - 2013-12-12 17:30 - 00000000 ____D () C:\Users\Bolle\AppData\Local\FreePDF_XP
2014-10-31 06:23 - 2013-12-09 15:16 - 00000000 ___RD () C:\Users\Bolle\Dropbox
2014-10-31 06:23 - 2013-12-09 10:50 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Dropbox
2014-10-31 06:23 - 2013-12-05 00:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-31 06:23 - 2013-12-05 00:28 - 00024944 _____ () C:\Windows\system32\Drivers\GVTDrv.sys
2014-10-31 06:23 - 2013-12-05 00:28 - 00017488 _____ (Windows (R) 2000 DDK provider) C:\Windows\gdrv.sys
2014-10-31 06:23 - 2013-12-05 00:28 - 00000004 _____ () C:\Windows\system32\GVTunner.ref
2014-10-31 06:23 - 2009-07-14 05:17 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-31 06:23 - 2009-07-14 05:07 - 00047418 _____ () C:\Windows\setupact.log
2014-10-29 19:22 - 2013-12-05 10:59 - 00000000 ____D () C:\Quellkotze
2014-10-29 17:29 - 2014-01-27 15:57 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\FileZilla
2014-10-29 15:55 - 2014-01-27 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-10-29 15:55 - 2014-01-27 15:57 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-10-29 11:20 - 2013-12-16 19:01 - 42183580 _____ () C:\ProgramData\downloaded_update.exe
2014-10-29 06:45 - 2014-09-19 05:44 - 396964435 _____ () C:\Windows\MEMORY.DMP
2014-10-29 06:45 - 2014-09-19 05:44 - 00000000 ____D () C:\Windows\Minidump
2014-10-27 15:15 - 2013-12-05 12:47 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\craniMAX
2014-10-27 15:10 - 2013-12-05 12:49 - 00376832 _____ (MARX CryptoTech LP ) C:\Windows\system32\MPIWIN32.DLL
2014-10-27 15:06 - 2013-12-09 17:50 - 00000000 ____D () C:\Buero
2014-10-27 15:01 - 2013-12-05 12:49 - 00000000 ____D () C:\Program Files\CRANIMAX
2014-10-27 12:24 - 2013-12-05 15:25 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Ulead Systems
2014-10-27 12:24 - 2013-12-05 10:35 - 00000000 ____D () C:\ProgramData\Ulead Systems
2014-10-27 10:29 - 2009-07-14 05:51 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-10-27 06:03 - 2013-12-05 01:37 - 00243508 _____ () C:\Windows\PFRO.log
2014-10-24 16:10 - 2013-12-05 12:49 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CRANIMAX
2014-10-23 15:40 - 2014-01-27 15:50 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\MySQL
2014-10-23 09:26 - 2013-12-05 01:41 - 00000000 ____D () C:\Users\Bolle\Documents\Visual Studio 2010
2014-10-23 09:18 - 2014-08-29 10:41 - 00000000 ____D () C:\Users\Bolle\AppData\Local\Adobe
2014-10-23 09:18 - 2013-12-05 11:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-23 09:18 - 2013-12-05 11:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-20 04:47 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-10-20 04:43 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-20 04:07 - 2009-07-14 05:02 - 00663416 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-20 04:06 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-17 17:08 - 2014-06-27 11:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 17:05 - 2014-06-27 11:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-09 12:01 - 2013-12-18 14:31 - 00000000 ____D () C:\ProgramData\Roxio
2014-10-09 06:36 - 2013-12-05 02:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-10-09 06:36 - 2013-12-05 00:18 - 00000000 ____D () C:\Users\Bolle
2014-10-09 06:36 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp
2014-10-09 06:36 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2014-10-09 06:14 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-10-08 13:51 - 2014-06-10 13:27 - 00288156 _____ () C:\Users\Bolle\AppData\Local\debuggee.mdmp
2014-10-07 18:18 - 2013-12-05 01:42 - 00000000 ____D () C:\Users\Bolle\Documents\Visual Studio 2008

Files to move or delete:
====================
C:\ProgramData\downloaded_update.exe


Some content of TEMP:
====================
C:\Users\Bolle\AppData\Local\Temp\AcDeltree.exe
C:\Users\Bolle\AppData\Local\Temp\amazonicon_v8.exe
C:\Users\Bolle\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\Bolle\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpooenmu.dll
C:\Users\Bolle\AppData\Local\Temp\FoxySecurity_6.2_GIGA_FF_IE_Setup.exe
C:\Users\Bolle\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Bolle\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Bolle\AppData\Local\Temp\ose00000.exe
C:\Users\Bolle\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Bolle\AppData\Local\Temp\sdapskill.exe
C:\Users\Bolle\AppData\Local\Temp\sdaspwn.exe
C:\Users\Bolle\AppData\Local\Temp\uninstall.exe
C:\Users\Bolle\AppData\Local\Temp\WEB.DE_MailCheck_FF_Setup_2.10.1.1735.exe
C:\Users\Bolle\AppData\Local\Temp\_is4B9F.exe
C:\Users\Bolle\AppData\Local\Temp\_is90FC.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-27 08:42

==================== End Of Log ============================
         

--- --- ---


Der Addition.txt war für diese Antwort zu lang - kommt gleich.

Hier nun der Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 30-10-2014 01
Ran by Bolle at 2014-10-31 10:14:54
Running from C:\Users\Bolle\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Disabled - Up to date) {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
AS: Kaspersky Internet Security (Disabled - Up to date) {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Disabled) {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

@BIOS (HKLM\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.24 - GIGABYTE)
Able2Extract Professional 7.0 (HKLM\...\{C894CC24-0DEC-4340-BCC9-DD4310DF3BEC}_is1) (Version: 7.0 - Investintech.com Inc.)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AGEIA PhysX v7.05.17 (HKLM\...\{27DC856A-0916-4988-8198-8714DDD3183D}) (Version: 7.05.17 - AGEIA Technologies, Inc.)
AIMP3 (HKLM\...\AIMP3) (Version: v3.50.1224 Beta 1, 31.01.2013 - AIMP DevTeam)
allday savings (HKLM\...\C13DB9D9-D8B8-4E8F-B4ED-BCFCC8C284E7) (Version: 2.0.1 - allday savings) <==== ATTENTION
Application Verifier (HKLM\...\{E72400F4-A41E-4019-9143-051BE2951C00}) (Version: 4.0.917 - Microsoft Corporation)
AutoCAD Mechanical 2013 - Deutsch (German) (HKLM\...\AutoCAD Mechanical 2013 - Deutsch (German)) (Version: 17.0.48.0 - Autodesk)
AutoCAD Mechanical 2013 - Deutsch (German) (Version: 17.0.48.0 - Autodesk) Hidden
AutoCAD Mechanical 2013 Language Pack - Deutsch (German) (Version: 17.0.48.0 - Autodesk) Hidden
Autodesk 3ds Max Design 2013 32-bit (HKLM\...\Autodesk 3ds Max Design 2013 32-bit) (Version: 15.0.0.347 - Autodesk)
Autodesk 3ds Max Design 2013 32-bit (Version: 15.0.0.347 - Autodesk) Hidden
Autodesk Backburner 2013.0.0 (HKLM\...\{3D347E6D-5A03-4342-B5BA-6A771885F379}) (Version: 2013.0.0 - Autodesk, Inc.)
Autodesk Civil View for 3ds Max Design 2013 (HKLM\...\{FE6DCC8D-427F-405C-A779-C93B6D9F77A5}) (Version: 1.0.0.2 - Autodesk)
Autodesk Content Service (HKLM\...\Autodesk Content Service) (Version: 3.0.84.0 - Autodesk)
Autodesk Content Service (Version: 3.0.84.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (Version: 3.0.84.0 - Autodesk) Hidden
Autodesk DirectConnect 2013 32-bit (HKLM\...\Autodesk DirectConnect 2013 32-bit) (Version: 7.0.28.0 - Autodesk)
Autodesk DirectConnect 2013 32-bit (Version: 7.0.28.0 - Autodesk) Hidden
Autodesk Essential Skills Movies for 3ds Max Design 2013 32-bit (HKLM\...\{7FD5D1E2-EF17-4045-8D83-BB8E88C0D672}) (Version: 1.0.0.1 - Autodesk)
Autodesk FBX Plug-in 2013.1 - 3ds Max Design 2013 (HKLM\...\Autodesk FBX Plug-in 2013.1 - 3ds Max Design 2013) (Version:  - Autodesk)
Autodesk Inventor 2013 (Version: 17.0.13800.0000 - Autodesk) Hidden
Autodesk Inventor 2013 Deutsch (German) (HKLM\...\Autodesk Inventor 2013) (Version: 17.0.13800.0000 - Autodesk)
Autodesk Inventor 2013 Language Pack - Deutsch (German) (Version: 17.0.13800.0000 - Autodesk) Hidden
Autodesk Inventor Server Engine for 3ds Max Design 2013 32-bit (HKLM\...\{BC66B242-DF13-1632-851B-00123612ED98}) (Version: 15.0 - Autodesk)
Autodesk Material Library 2013 (HKLM\...\{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2013 (HKLM\...\{606E12B9-641F-4644-A22A-FF38AE980AFD}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Low Resolution Image Library 2013 (HKLM\...\{27C6C0A2-2EC9-4FEA-BE2B-659EAAC2C68C}) (Version: 3.0.13 - Autodesk)
Autodesk Material Library Medium Resolution Image Library 2013 (HKLM\...\{58760EEC-8B6A-43F4-81AA-696E381DFADD}) (Version: 3.0.13 - Autodesk)
Autodesk Product Design Suite 2013 Language Pack (Version: 2.0.100.006 - Autodesk) Hidden
Autodesk Product Design Suite 2013 Schnelle Deinstallation (HKLM\...\{D28EFBA5-1732-4B79-946A-000BE950E8E2}) (Version: 17.0.0.0 - Autodesk)
Autodesk Product Design Suite Premium 2013 (HKLM\...\Autodesk Product Design Suite Premium 2013) (Version: 2.0.100.006 - Autodesk)
Autodesk Product Design Suite Premium 2013 (Version: 2.0.100.006 - Autodesk) Hidden
Autodesk Revit Interoperability for 3ds Max and 3ds Max Design 2013 32-bit (HKLM\...\{06E18300-BB64-1632-8E6A-2593FC67BB74}) (Version: 1.0.0.1 - Autodesk)
Autodesk Sync (HKLM\...\{EE5F74BC-5CD5-4EF2-86BA-81E6CF46A18F}) (Version: 3.5.24.0 - Autodesk, Inc.)
Autodesk Workflows - Product Design Suite 2013 (HKLM\...\{06388E0D-A386-478B-8E40-7D76142A8DF5}) (Version: 3.0.10.0 - Autodesk)
AutoGreen B12.0206.1 (HKLM\...\InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}) (Version: 1.00.0000 - GIGABYTE)
AutoGreen B12.0206.1 (Version: 1.00.0000 - GIGABYTE) Hidden
Brother P-touch Editor 5.0 (HKLM\...\InstallShield_{DF9A6075-9308-4572-8932-A4316243C4D9}) (Version: 5.0.110 - Brother Industries, Ltd.)
Brother P-touch Editor 5.0 (Version: 5.0.110 - Brother Industries, Ltd.) Hidden
Brother P-touch Software User's Guide (HKLM\...\InstallShield_{FD525A47-5E7A-4970-A896-C520E270B079}) (Version: 1.00.0000 - Brother Industries, Ltd.)
Brother P-touch Software User's Guide (Version: 1.00.0000 - Brother Industries, Ltd.) Hidden
CameraHelperMsi (Version: 13.51.815.0 - Logitech) Hidden
Canon iP4700 series Benutzerregistrierung (HKLM\...\Canon iP4700 series Benutzerregistrierung) (Version:  - )
Canon iP4700 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series) (Version:  - )
Canon iP4900 series Benutzerregistrierung (HKLM\...\Canon iP4900 series Benutzerregistrierung) (Version:  - )
Canon iP4900 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4900_series) (Version:  - )
Canon iP7200 series Benutzerregistrierung (HKLM\...\Canon iP7200 series Benutzerregistrierung) (Version:  - Canon Inc.‎)
Canon iP7200 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP7200_series) (Version:  - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5118 - CDBurnerXP)
CD-LabelPrint (HKLM\...\MediaNavigation.CDLabelPrint) (Version:  - )
Chrome Embedded Browser version 3.1547.32 (HKLM\...\Chrome Embedded Browser_is1) (Version: 3.1547.32 - NuSphere Corp.)
CINEMA 4D 13.061 (HKLM\...\MAXONFB05E576) (Version: 13.061 - MAXON Computer GmbH)
Cisco WebEx Meetings (HKCU\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
CommandBurner 3.5 (HKLM\...\CommandBurner_is1) (Version:  - Cortex I.T.)
Composite 2013 (HKLM\...\{92203FA0-7C43-429F-857C-0AE197D8199C}) (Version: 8.0.0 - Autodesk)
Corel Painter Essentials 3 (HKLM\...\_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF}) (Version:  - Corel Corporation)
Corel Painter Essentials 3 (Version: 3.2 - Corel Corporation) Hidden
CRANE MANAGER 2011 (HKLM\...\CRANE MANAGER 2011) (Version: 2011 - craniMAX GmbH)
CRANE MANAGER 2014 (HKLM\...\CRANE MANAGER 2014) (Version: 2014 - craniMAX GmbH)
Crystal Reports Basic for Visual Studio 2008 (HKLM\...\{AA467959-A1D6-4F45-90CD-11DC57733F32}) (Version: 10.5.0.0 - Business Objects)
Crystal Reports Basic German Language Pack for Visual Studio 2008 (HKLM\...\{3924C3E7-C440-4B23-9740-9A9EC0545F21}) (Version: 10.5.0.0 - Business Objects)
Crystal Reports for Visual Studio (Version: 12.51.0.240 - SAP) Hidden
CSE HTML Validator Lite v11.02 (HKLM\...\CSEHTMLVALIDATORLITE110_is1) (Version:  - AI Internet Solutions LLC)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Debugging Tools for Windows (x86) (HKLM\...\{300A2961-B2B5-4889-9CB9-5C2A570D08AD}) (Version: 6.11.1.404 - Microsoft Corporation)
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Dotfuscator Software Services - Community Edition - DEU (HKLM\...\{CE9BAD6E-60FC-46CC-82A2-5B0F2B1A0E36}) (Version: 5.0.2300.0 - PreEmptive Solutions)
Dotfuscator Software Services - Community Edition (HKLM\...\{1AA5BD63-6614-44B2-88A7-605191EDB835}) (Version: 5.0.2500.0 - PreEmptive Solutions)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
DWG TrueView 2013 (HKLM\...\DWG TrueView 2013) (Version: 19.0.55.0 - Autodesk)
DWG TrueView 2013 (Version: 19.0.55.0 - Autodesk) Hidden
Easy Tune 6 B12.0402.1 (HKLM\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.0402.1 (Version: 1.00.0000 - GIGABYTE) Hidden
Eco Materials Adviser for Autodesk Inventor 2013 (HKLM\...\{39FF4C41-0C7E-498D-ABAA-3CC74830BA53}) (Version: 3.9.12.0 - Granta Design Limited)
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
FARO LS 1.1.406.58 (HKLM\...\{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}) (Version: 4.6.58.2 - FARO Scanner Production)
FileZilla Client 3.9.0.6 (HKLM\...\FileZilla Client) (Version: 3.9.0.6 - Tim Kosse)
Firefox Browser (remove only) (HKLM\...\Firefox Browser) (Version:  - )
FLV Player (remove only) (HKLM\...\FLVM Player) (Version:  - ) <==== ATTENTION
FreePDF (Remove only) (HKLM\...\FreePDF_XP) (Version:  - )
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
HM NIS Edit 2.0.3 (HKLM\...\HM NIS Edit) (Version: 2.0.3 - Hector Maurcio Rodriguez Segura)
IcoFX 1.6.4 (HKLM\...\IcoFX_is1) (Version:  - )
Iconion (HKLM\...\Iconion_is1) (Version:  - )
Kaspersky Internet Security 2013 (HKLM\...\InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}) (Version: 13.0.1.4190 - Kaspersky Lab)
Kaspersky Internet Security 2013 (Version: 13.0.1.4190 - Kaspersky Lab) Hidden
LICCON Einsatzplaner (HKLM\...\LIKAPLAN) (Version: 5.5 - LIEBHERR-Werk Ehingen GmbH)
Logitech Unifying-Software 2.10 (HKLM\...\Logitech Unifying) (Version: 2.10.37 - Logitech)
Logitech Webcam-Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)
MCG Compu-Crane 4.0.2 (HKLM\...\{1966F561-9B31-4507-BA39-A02F773E8BD9}) (Version: 4.0.2 - Manitowoc Crane Group)
Microsoft .NET Compact Framework 2.0 SP2 (HKLM\...\{B1060346-9388-4C5B-AA52-176C39819E43}) (Version: 2.0.7045 - Microsoft Corporation)
Microsoft .NET Compact Framework 3.5 (HKLM\...\{72CCBEA1-8D57-4981-A337-81019F28C5BA}) (Version: 3.5.7283 - Microsoft Corporation)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access 2010 (HKLM\...\Office14.AccessR) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Access database engine 2010 (English) (HKLM\...\{90140000-00D1-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 - DEU (HKLM\...\{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}) (Version: 2.0.50331.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU (HKLM\...\{31C3C6EA-E991-405F-A3AA-2C070CCCC47C}) (Version: 2.0.50331.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (HKLM\...\{40416836-56CC-4C0E-A6AF-5C34BADCE483}) (Version: 2.0.50217.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 (HKLM\...\{1803A630-3C38-4D2B-9B9A-0CB37243539C}) (Version: 2.0.50217.0 - Microsoft Corporation)
Microsoft Device Emulator Version 3.0 - DEU (HKLM\...\{4E3A817A-8033-3D7E-BCA9-102EFF3FD9CA}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Document Explorer 2008 (HKLM\...\Microsoft Document Explorer 2008) (Version:  - Microsoft Corporation)
Microsoft Document Explorer 2008 Language Pack - DEU (HKLM\...\Microsoft Document Explorer 2008 Language Pack - DEU) (Version:  - Microsoft Corporation)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Help Viewer 1.1 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.1 Language Pack - DEU) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50826.0 - Microsoft Corporation)
Microsoft Silverlight 3 SDK - Deutsch (HKLM\...\{91F54E1D-804A-46D8-A56C-53EA9C4B3177}) (Version: 3.0.40818.0 - Microsoft Corporation)
Microsoft Silverlight 4 SDK - Deutsch (HKLM\...\{803910CC-3A39-45E3-A594-0D5512A60A86}) (Version: 4.0.50826.0 - Microsoft Corporation)
Microsoft SQL Server 2008 (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 Browser (HKLM\...\{4AF2248C-B3DF-46FB-9596-87F5DB193689}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{1C2B3CEA-482E-4453-B3E2-C9731337828A}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM\...\{E9089B6A-1FDE-47F3-8D29-175F5B7A0722}) (Version: 10.50.1750.9 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Transact-SQL-Sprachdienst (HKLM\...\{B1F7AB4B-25B1-46B1-A3A0-FD652C3D62BE}) (Version: 10.50.1750.9 - Microsoft Corporation)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework (HKLM\...\{919E5477-D20B-4F64-AE8B-8199469F7817}) (Version: 10.50.1750.9 - Microsoft Corporation)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Projekt (HKLM\...\{103A5E44-DD5B-46D5-AD1E-9DF2260CA023}) (Version: 10.50.1750.9 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 Design Tools DEU (HKLM\...\{E32260E7-0B10-43C7-9B77-AB9F4184676D}) (Version: 3.5.5386.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 for Devices DEU (HKLM\...\{1C3ADB5F-750E-4453-AC98-B75C5323845C}) (Version: 3.5.5386.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Database Publishing Wizard 1.2 (HKLM\...\{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}) (Version: 1.2.0.0 - Microsoft Corporation)
Microsoft SQL Server Database Publishing Wizard 1.4 (HKLM\...\{ACE28263-76A4-4BF5-B6F4-8BD719595969}) (Version: 10.1.2512.8 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM\...\{C668416A-9213-4058-B7F2-01A42D85559D}) (Version: 10.50.1750.9 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{D074DC76-F6C9-440E-A1D0-1DE958417FDB}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 SP1 (x86) de (HKLM\...\{DB0AF767-7CC7-4E4D-B6BE-A200F20A2FB1}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework SDK v1.0 SP1 de (HKLM\...\{03A4C6A1-26E9-4DDB-81D9-B332E5BB10AD}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 SP1 (x86) de (HKLM\...\{EAF7B35C-DCBE-4032-9ABF-C35C43D07124}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) de (HKLM\...\{D6A6CFAD-CD86-482B-90D1-6FCC4E252ACD}) (Version: 2.0.3010.0 - Microsoft Corporation)
Microsoft Team Foundation Server 2010-Objektmodell - DEU (HKLM\...\Microsoft Team Foundation Server 2010 Object Model - DEU) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (HKLM\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ Compilers 2008 Standard Edition - enu - x86 (HKLM\...\{44D9A2CB-0692-3180-B5E2-26F4E807D067}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual F# 2.0 Runtime (HKLM\...\{85467CBC-7A39-33C9-8940-D72D9269B84F}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual F# 2.0 Runtime Language Pack - DEU (HKLM\...\{681F4E9F-34E0-36BD-BF2C-100554E403A5}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack (HKLM\...\Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack) (Version:  - Microsoft Corporation)
Microsoft Visual Studio 2008 Professional Edition - DEU (HKLM\...\Microsoft Visual Studio 2008 Professional Edition - DEU) (Version:  - Microsoft Corporation)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM\...\{616C6F39-4CE1-3434-A665-2F6A04C09A7F}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Professional - DEU (HKLM\...\Microsoft Visual Studio 2010 Professional - DEU) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (HKLM\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.31007 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.31007 - Microsoft Corporation)
Microsoft Visual Studio Macro Tools - DEU Language Pack (HKLM\...\Microsoft Visual Studio Macro Tools - DEU Language Pack) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Macro Tools (HKLM\...\Microsoft Visual Studio Macro Tools) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Web Authoring Component (HKLM\...\VisualWebDeveloper) (Version: 12.0.4518.1066 - Microsoft Corporation)
Microsoft Windows Debugging Symbols (HKLM\...\{46EA439E-2D16-49B6-AA80-00DE992FE7CE}) (Version: 7601 - Microsoft)
Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools (HKLM\...\{99F0C3CC-8DF0-3611-B190-CF4D1AF0E053}) (Version: 3.5.21022 - Microsoft)
Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries (HKLM\...\{842FAF7C-50EF-4463-9B8F-6222E1384D7D}) (Version: 6.1.5288.17011 - Microsoft Corporation)
Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense (HKLM\...\{64c5b887-b5ee-42b8-8596-78905a6b5f1f}) (Version: 6.1.5288.17011 - Microsoft Corporation)
Microsoft Windows SDK for Visual Studio 2008 Tools (HKLM\...\{CAA376AF-0DE8-4FCA-942E-C6AC579B94B3}) (Version: 6.1.5288.17011 - Microsoft Corporation)
Microsoft Windows SDK for Visual Studio 2008 Win32 Tools (HKLM\...\{B268E9A1-04A9-40D0-9866-846BE2B74BA7}) (Version: 6.1.5288.17011 - Microsoft Corporation)
Microsoft Windows SDK for Windows 7 (7.0) (HKLM\...\SDKSetup_7.0.7600.16385.40715) (Version: 7.0.7600.16385.40715 - Microsoft Corporation)
Mozilla Embedded Browser version 18.0.2 (HKLM\...\Mozilla Embedded Browser_is1) (Version: 18.0.2 - NuSphere Corp.)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MySQL Connector Net 6.7.4 (HKLM\...\{D6952EDA-6AC4-4480-A060-BD6025B15BAD}) (Version: 6.7.4 - Oracle)
MySQL Query Browser 1.1 (HKLM\...\{1444B16A-766B-4AD1-8AE8-F0C04C782E2F}) (Version: 1.1.20 - MySQL AB)
Nullsoft Install System (HKLM\...\NSIS) (Version: 2.46 - )
NuSphere PhpED version 14.0 (HKLM\...\NuSphere PhpED_is1) (Version: 14.0 - NuSphere Corp.)
NVIDIA 3D Vision Controller-Treiber 296.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 296.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.12.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.12.0 - NVIDIA Corporation)
NVIDIA nView 136.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 136.28 - NVIDIA Corporation)
NVIDIA WMI 2.16.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.16.1 - NVIDIA Corporation)
ON_OFF Charge B11.1102.1 (HKLM\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
Php Documentor version 2.0 for NuSphere PhpED (HKLM\...\PHP Documentor_is1) (Version: 12.0 - NuSphere Corp.)
php-4.4.9 for NuSphere PhpED (HKLM\...\PHP_is1) (Version: 12.0 - NuSphere Corp.)
php-5.2.17 for NuSphere PhpED (HKLM\...\PHP5_is1) (Version: 12.0 - NuSphere Corp.)
php-5.4.23 for NuSphere PhpED (HKLM\...\PHP54_is1) (Version: 12.0 - NuSphere Corp.)
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6554 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Roxio Creator Audio (HKLM\...\{83FFCFC7-88C6-41c6-8752-958A45325C82}) (Version: 3.3.0 - Roxio)
Roxio Creator Copy (HKLM\...\{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}) (Version: 3.3.0 - Roxio)
Roxio Creator Data (HKLM\...\{0D397393-9B50-4c52-84D5-77E344289F87}) (Version: 3.3.0 - Roxio)
Roxio Creator DE (HKLM\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.3.0 - Roxio)
Roxio Creator Tools (HKLM\...\{0394CDC8-FABD-4ed8-B104-03393876DFDF}) (Version: 3.3.0 - Roxio)
Roxio Drag-to-Disc (HKLM\...\{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}) (Version: 9.0 - Roxio)
Roxio Express Labeler (HKLM\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 2.1.0 - Roxio)
Roxio MyDVD DE (HKLM\...\{D639085F-4B6E-4105-9F37-A0DBB023E2FB}) (Version: 9.0.117 - Roxio, Inc.)
Roxio Update Manager (HKLM\...\{30465B6C-B53F-49A1-9EBA-A3F187AD502E}) (Version: 3.0.0 - Roxio)
Service Pack 1 für SQL Server 2008 (KB 968369) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
Snagit 9.1.2 (HKLM\...\{B440D659-FECA-4BDD-A12B-5C9F05790FF3}) (Version: 9.1.2.124 - TechSmith Corporation)
Sonic Activation Module (Version: 1.0 - Sonic Solutions) Hidden
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
Tom Clancy's Ghost Recon Advanced Warfighter® 2 (HKLM\...\{F78AC3C0-578C-49AB-BD4E-3107A6036A13}) (Version: 1.05 - UBISOFT)
TotalAudioConverter (HKLM\...\Total Audio Converter_is1) (Version: 5.1 - Softplicity, Inc.)
TOWER MANAGER 2012 (HKLM\...\TOWER MANAGER 2012) (Version: 2012 - craniMAX GmbH)
Ulead PhotoImpact X3 (HKLM\...\InstallShield_{15803703-25FA-4C01-A062-3F4A59937E87}) (Version: 1.00.0000 - Corel)
Ulead PhotoImpact X3 (Version: 1.00.0000 - Corel) Hidden
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (HKLM\...\{9AA2D735-3375-42D4-9A61-3FFEF82599D6}) (Version: 10.1.2731.0 - Microsoft Corporation)
VBA (2627.01) (Version: 6.03.00.9402 - Microsoft Corporation) Hidden
VBA (2701.01) (Version: 6.03.00.9402 - Microsoft Corporation) Hidden
VC Runtimes MSI (Version: 9.0.21022 - Microsoft) Hidden
Visual C++ 2008 IA64 Runtime - v9.0.30729.01 (HKLM\...\{22E23C71-C27A-3F30-8849-BB6129E50679}.vc_i64runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
Visual C++ 2008 x64 Runtime - v9.0.30729.01 (HKLM\...\{0DF3AE91-E533-3960-8516-B23737F8B7A2}.vc_x64runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (HKLM\...\{CFCB8616-A5D1-4281-80E8-389F685BFAE2}) (Version: 4.0.8080.0 - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio-Tools für Office System 3.0 Runtime Language Pack - DEU (HKLM\...\Visual Studio Tools for the Office system 3.0 Runtime Language Pack - DEU) (Version:  - Microsoft Corporation)
VLC media player 1.0.3 (HKLM\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
WCF RIA Services V1.0 SP1 (HKLM\...\{D9E6001A-5DC3-4620-AF7A-80B6CD48645D}) (Version: 4.1.60114.0 - Microsoft Corporation)
Web Deployment Tool (HKLM\...\{0F37D969-1260-419E-B308-EF7D29ABDE20}) (Version: 1.1.0618 - Microsoft Corporation)
Windows Mobile 5.0 SDK R2 for Pocket PC (HKLM\...\{721B5CF0-D220-4955-BB6F-EBCFB1096DE7}) (Version: 5.00.1700.5.14343.06 - Microsoft Corporation)
Windows Mobile 5.0 SDK R2 for Smartphone (HKLM\...\{DA7F48EF-5F56-45FE-9169-3B8159A7A323}) (Version: 5.00.1700.5.14343.06 - Microsoft Corporation)
WinRAR 5.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WSE_Astromenda (HKCU\...\WSE_Astromenda) (Version:  - WSE_Astromenda) <==== ATTENTION
WSE_Astromenda (HKLM\...\Astromenda) (Version:  - Astromenda) <==== ATTENTION
WSE_Astromenda (HKLM\...\WSE_Astromenda) (Version:  - WSE_Astromenda) <==== ATTENTION
XAMPP 1.7.4 (HKLM\...\xampp) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Bolle\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{00F064D8-FEC3-48ac-B07D-39C314D1727B}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{0215A4C0-5431-4FD0-9B06-46589B5C4939}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{048ED0E0-12CF-4C0F-9FFA-947C2FBE8C8E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{071339A1-1946-44B2-B63E-50459B15DB86}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{073CB204-6B29-46FC-AB98-451F1D068741}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{08A60FF7-BB37-44F4-9759-0ADA6C7B9CC9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{0B38CACA-3D3C-48EA-BEB5-7D95F4F6EE15}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{0BBFE402-CCA1-4f64-9322-13B66D841049}\InprocServer32 -> C:\Users\Bolle\AppData\Local\TechSmith\SnagIt\Accessories\{23102CBF-AC8D-4424-9364-A79738894850}\MSWord.dll (TechSmith Corporation)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{0C3393F8-94F5-4B79-8C01-49A2D0CC0FE9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{0D555CE0-304A-47A6-858B-B145209A3982}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1029ABC3-2457-11D5-8E9D-0010B541CD80}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{12545889-6D32-4424-9967-1E1D7BD1F809}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{13009989-EFB5-48C9-8BD2-943E0392BD71}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\RxAppCtrl.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{14679E3B-C952-4998-8E13-4B1286E6DD99}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1481B385-759A-4B00-9257-E96357563999}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{162EF0A1-5A33-46F2-ACCF-CA388B084A09}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{18A21864-E37B-42b9-9612-2C1E8C450A29}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1D625598-C876-4C51-8EF5-F9D8F96F62AA}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1D6DFD6A-9E16-435A-9327-6FFEC6BA372F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1E5724EA-3423-4BD3-ABD6-46E650D2DC66}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1E8A29BA-827D-4031-A4A3-AE7999B402F6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1EA072EE-57FD-495E-889C-8243C3BDBDBC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{1FD7F53F-7ED5-439C-9A77-A3821CD09E98}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{20E47D5B-529A-45BD-8E77-BF1A3064A008}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{21DB88B0-BFBF-11D4-8DE6-0010B541CAA8}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\iDrop.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{244298EC-E661-11d4-BC13-0010B5891E89}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\TI.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{25D005BF-FE63-4cce-AA25-CE952B1D9381}\InprocServer32 -> C:\Users\Bolle\AppData\Local\TechSmith\SnagIt\Accessories\{638B203F-8FB6-49ec-A139-AB8C530F0CAB}\MSPowerPoint.dll (TechSmith Corporation)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{2709544A-5B24-4F9F-A5DA-CEC7297D3A4E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{2BCA857B-A18B-4AFA-B183-CC0E49C12058}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{2C74F89E-7421-46B4-BA54-F86F1BD9F237}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{2C7D1157-7D50-4A88-9777-5EBBA3189AB8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{2F8377FC-50C1-44EF-AB7A-8FF1BB8EA277}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{3497C2EC-5684-4B21-AF74-F6760E0221DC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{3897B445-D5B8-410d-899A-9789B8ADB643}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{38C8B14E-7879-4DA9-8C3F-8CAAC359293A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{3C3F63EA-C7BA-11d4-8E60-0010B541CD80}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Compatibility\Bin\DbxBridge.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2013\en-US\dwgviewrficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{3FC94EB5-AEBD-4f3f-A2A4-B6CE57113C01}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\RxAppDocView.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{3FCEB42C-9B98-486A-BED7-FD7F3ADB7291}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{40770568-0D5E-49D4-BE47-BC47A4F0B0A4}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{44A52280-AE56-490D-890C-89FB7279ED6B}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{45122C53-8483-4b62-B15A-EAA9FE5FC3D5}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{46C56738-39C6-4240-8B9B-008CCD769A84}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{47179DDE-10AC-4737-97C9-8CE5379343EA}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{475C7B4A-6964-4F9E-9708-05A16EAC31D0}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{48270F9E-CCF6-4C79-B6FF-267C960E6425}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{48FEFCD7-5D7C-4E4A-9F11-60E69A31D4B1}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{49998808-648A-4A9C-A7A5-B1672775D9AB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{4A756F5F-CBA4-428B-B17F-AF80C0C8502D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{4B40437B-8972-4444-BBE3-1588FF55F203}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{4BD03680-3C0F-4501-AFF7-3D008586917F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{4C80573A-9150-11d2-B772-0060B0F159EF}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\RxAppDocView.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{4D29B490-49B2-11D0-93C3-7E0706000000}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{4E6F2E83-E7F0-4333-9772-875EB733C820}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\RxTest.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{54050FBB-F2AE-404b-8BFD-7EE3EC784A52}\InprocServer32 -> C:\Users\Bolle\AppData\Local\TechSmith\SnagIt\Accessories\{18AA4E21-D540-4a3a-9F9F-E6DE33D6F253}\MSExcel.dll (TechSmith Corporation)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{5544903C-2CCC-487C-91BB-F310B72A8E9B}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{59A224A2-BEF8-4C89-96E0-83A5411ABB6C}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{622F6193-E4DD-46E6-BC66-2ED88E9FD28D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{62FBB030-24C7-11D3-B78D-0060B0F159EF}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{644190AE-BD8F-493F-B63D-C79404AC5E07}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6451051B-AD22-4C6A-ACCE-013A0E1DDBC3}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{64B99FDB-1D85-447F-98C7-569DBDA723DB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2013\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6B1948B3-9547-42F8-9B37-7AA9768134C4}\InprocServer32 -> C:\Users\Bolle\AppData\Local\TechSmith\SnagIt\Accessories\{23102CBF-AC8D-4424-9364-A79738894850}\MSWord.dll (TechSmith Corporation)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6BCE6F6E-C050-4F39-BD98-E2743949F724}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6F56D7C9-18DD-4C15-9FA8-C54E3610EC40}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6FDE7A70-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6FDE7A71-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6FDE7A72-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6FDE7A73-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6FDE7A74-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{6FDE7A77-351B-11d6-988B-0010B57A8BB7}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtCp.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{70DBCAE8-8C2B-450C-9E1D-43E4686C6512}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{713C0E8A-5AE8-4695-B442-5ED6C4FE5C42}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{7293E009-3015-4AD3-96EC-D42C36B5FCE3}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{72EC5CC5-88F3-45B1-A865-0A327DF58CC8}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{72EFC580-D085-4B81-8C55-26A79E445338}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{750AEC19-2E4C-4ED9-9B9F-F9CAFCD060F3}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{76283A80-50DD-11D3-A7E3-00C04F79D7BC}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{794199C5-827C-41C8-8CB2-3A1EA056AF5E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{798391FE-4AF2-4851-9DDA-1F0D70C02A9E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{7C239DAB-BC87-45F3-B7B1-FCC1541A235B}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{81D07C3D-0350-11D3-B7C2-0060B0EC020B}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\RxAppCtrl.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{834CE679-2E47-49DE-9E41-FEC87E9192EB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{8421A29C-54B8-11D1-9837-0060B03C43C8}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\SolidObject.Dll ()
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{846217D0-8954-11D2-8DCD-0060B0C32531}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\UCxTextBtn.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{846217D1-8954-11D2-8DCD-0060B0C32531}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\UCxTextBtn.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{849AFB5B-D6C9-4924-A712-F7118FF9611F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{85452F88-5071-492E-B850-2E3C586DCBD8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{87F5CF8F-A06D-498F-A05F-E520E6B570DB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{89F0FC31-3B1D-494B-A75B-6BD4FA527B8A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{8AA16DFC-DFC6-4B51-8FA2-A5D812BE33BF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{8B0E6BD9-610C-11D1-9842-0060B03C43C8}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\SolidObject.Dll ()
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{8C23B656-4E6E-4B45-9920-9617168D39A3}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{8ED07FEF-E1B0-4CC3-B2BA-D354828AB952}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{97E17F04-17DF-11d5-BC38-0010B5891E89}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\BodyReceiver.dll ()
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{988F4102-E6E3-4282-ACAC-55270827F2A8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{9906CDFC-DB2C-4126-9422-13139B148495}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{9A21C6C5-27FC-4442-8590-575E7AFD73BB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{9ECF83FB-23C5-43B6-83DE-93CFBDD74D4A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{A58F47CC-FF65-4152-B0B1-666C643A5BFC}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{A6A3D586-44CF-44C2-A92C-620BB713B4F2}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{ABBE3F83-D585-4A50-9B69-198B0F566F2E}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{AC5CECFA-F03A-41D2-A89C-704C44935941}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B1560245-190E-4BBD-81DF-9B642D0E5325}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B2A579E0-A797-40B1-8AEE-A8F6404719F8}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{b2b568c8-3712-4a75-b806-4b3c2fdb06d5}\localserver32 -> C:\Users\Bolle\AppData\Local\Temp\{e9513610-f218-4dda-b954-2c7e6ba7cabb}\IDriver.NonElevated.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B47196BC-D4AB-41BB-A771-543D67CFC9F5}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B53CEF4B-1A13-49DE-BBC5-A7100FB2F38C}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B5EE2B68-9A23-4BCD-BB77-FEA6DFB24DD6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B6B5DC40-96E3-11d2-B774-0060B0F159EF}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B80687F9-FA4C-4735-9DC4-E5715F2BC698}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{B8E7214B-25CA-4116-84CB-E86FB9625B36}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BAE5802A-CF21-4F9C-AE04-D98F4036AC31}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BBF6A206-CB04-479D-96AE-349E1E83319A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BBF9FDF1-52DC-11D0-8C04-0800090BE8EC}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BC71DEA1-D6FB-48B8-AB06-D151C81BBCDD}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BD0DEB94-63DB-4392-9420-6EEE05094B1F}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2013\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BE54741D-E02B-4572-93D6-105AF4EDE777}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BF224DC3-B602-4EEE-BFE9-9E4E0AED6837}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{BF4CC07E-E9BB-40D6-873F-855B211033B9}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{C061C82C-D041-4214-BB07-B608107CEFCB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{C2D4ACCC-A3D1-4A0A-AD59-0DD8BA3D5EE1}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{C343ED84-A129-11d3-B799-0060B0F159EF}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\RxApprenticeServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{C8C18F89-794D-466B-8B97-95634D9890EF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{C8EC7647-1E79-4F13-81D7-2EED803D0D22}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{C92F8F8C-8B2C-11d4-B872-0060B0EC020B}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{CC23CA32-9892-4FBA-A108-FE31CA0F35A6}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{CD865713-70D6-4E15-BB7B-9B99AD9DEB85}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{CFEE2BAF-14F9-4D23-853D-B6E2BCC14263}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{D56F5AB3-9C4D-4F1A-A851-A671D9FE8C22}\InprocServer32 -> AcETransmit.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{D66873EA-AAE5-41CC-8DD2-8CE3228E9F89}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{D7A1987D-4A73-11D1-9A4B-080009DCE505}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ColorButton.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{D7A1987E-4A73-11D1-9A4B-080009DCE505}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ColorButton.Ocx (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{D86B6C47-11F2-4D95-B635-EA575F0892FC}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DA1F437C-9BD9-11d4-B87C-0060B0EC020B}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\DtBridge.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DB207560-8449-4FAF-BDC2-61676EB012D4}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DB5D476B-3FF4-4E9D-A606-1E2B473BE571}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\AcInetUI.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DCA7356C-FF94-4b20-AE04-7AA6A8E14117}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DDA9A20F-5B56-49F5-9465-CE82FC199352}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DE6B563C-B074-4BF1-A8A0-B3FED8703E99}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DE74F5AD-DA2F-429F-BAF9-850A2808D585}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{DF6525C2-6358-4B07-813D-708120C5FE1A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E177A457-9EAA-43C3-A3CE-84874A28F6CA}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E1C85E9F-60B2-4007-80C3-2C5E09474C3B}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\RxInventorUtilities.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E29F6C45-6927-4508-8F3F-34105FD3FC5F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2013\de-DE\acadficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E4222C78-3670-4BB1-9AD4-7D8F3E581F2D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E5B0515D-48D2-4F04-906D-0192ED65A2DD}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\TestServer.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E60F81E1-49B3-11D0-93C3-7E0706000000}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\Inventor.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E70DE962-842A-4488-9481-1D0FD72A020F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{E9C07CEC-7B82-49E4-BBA2-7533B88E9D64}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{EA34A0C0-5CE7-4701-A6FA-117D25CD5EBB}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{EF01D98A-747B-4522-AD70-991B90855DBF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F13E75B9-6AF6-49CB-80B3-6D2FF6E09932}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F196F03F-651A-43AF-BE34-D11942F24445}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F2DB0EE3-7137-4CB0-8349-483C4FF2143A}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F40E2FF0-4D77-40B2-9A44-A3AEECCE8EFF}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F5522F0C-962A-48AC-9992-E81B07628F1F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F61064CC-DBFB-47ee-9BC8-CA5A1CBDF0DA}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\InvResc.dll (Autodesk)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F78DCF7C-043D-45FC-9D21-676FC307BA3F}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{F868EAEC-1B73-4F5E-BA73-90EBA94E75BE}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FA62F626-EBD5-4dc5-B970-D9E81E0E20E0}\InprocServer32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\ServiceModule.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FA97F7A7-FD19-4D55-ABF2-CFEFFF777426}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FB469644-3F14-4403-ACCA-6B13486FF7BD}\localserver32 -> C:\Program Files\Autodesk\Inventor 2013\Bin\InvTXTStack.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FD51ED8A-D518-4554-B236-B6E9D234FD03}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FE054BB2-AF94-40AC-88AA-2F59F7018B1D}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FE317223-8EDE-4684-B424-E48B9EA90220}\InprocServer32 -> axdb.dll No File
CustomCLSID: HKU\S-1-5-21-3000836441-3054148485-1156403926-1000_Classes\CLSID\{FE718E8F-C3AA-4F30-9103-432450CF1DA1}\InprocServer32 -> axdb.dll No File

==================== Restore Points  =========================

29-09-2014 16:05:53 Windows Update
01-10-2014 16:28:56 Windows Update
07-10-2014 17:20:42 Windows Update
13-10-2014 16:53:30 Windows Update
17-10-2014 16:04:52 Windows Update
27-10-2014 07:49:52 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3D860523-DE94-405A-AAF6-F2E9691A412F} - System32\Tasks\ASP => C:\Program Files\RCP\systweakasp.exe
Task: {4844F735-0D5C-4557-B050-5733EEF6097E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-23] (Adobe Systems Incorporated)
Task: {49125C77-D254-42F3-B1EA-F21BB37044A1} - System32\Tasks\MySearchDial => C:\Users\Bolle\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {4E4B5000-FCFC-4C00-84B0-10369384F536} - System32\Tasks\WSE_Astromenda => C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\UpdateTask.exe [2014-08-12] ()
Task: {D9DBE298-919C-4CAB-878A-A7E8690677C0} - \BonanzaDealsUpdate No Task File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\MySearchDial.job => C:\Users\Bolle\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\WSE_Astromenda.job => C:\Users\Bolle\AppData\Roaming\WSE_AS~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-06-27 12:40 - 2014-03-20 22:03 - 02058184 _____ () C:\Windows\system32\nvwmi.exe
2013-12-05 01:36 - 2012-08-18 11:31 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2010-03-14 20:52 - 2010-03-14 20:52 - 00077876 _____ () c:\xampp\apache\bin\zlib1.dll
2013-12-05 00:33 - 2014-03-04 13:34 - 00109000 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2012-08-17 21:39 - 2013-12-05 11:53 - 01310136 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\kpcengine.2.2.dll
2011-09-15 05:19 - 2011-09-15 05:19 - 00086016 _____ () C:\Program Files\Autodesk\3ds Max Design 2013\NVIDIA\raysat_3dsmax2013_32server.exe
2010-12-03 19:18 - 2010-12-03 19:18 - 08133120 _____ () c:\xampp\mysql\bin\mysqld.exe
2006-11-02 20:40 - 2006-11-02 20:40 - 00174656 _____ () C:\Windows\system32\PSIService.exe
2010-03-14 20:52 - 2010-03-14 20:52 - 00077876 _____ () C:\xampp\apache\bin\zlib1.dll
2014-10-16 10:15 - 2014-10-16 10:15 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll
2013-12-18 14:35 - 2006-10-26 16:21 - 00056056 _____ () C:\Windows\system32\DLAAPI_W.DLL
2012-01-13 14:04 - 2012-01-13 14:04 - 00219760 _____ () C:\Program Files\GIGABYTE\ET6\GUI.exe
2012-04-02 16:52 - 2012-04-02 16:52 - 02822215 _____ () C:\Program Files\GIGABYTE\ET6\Normal.dll
2012-03-26 09:23 - 2012-03-26 09:23 - 00614467 _____ () C:\Program Files\GIGABYTE\ET6\work.dll
2011-12-06 14:44 - 2011-12-06 14:44 - 00106496 _____ () C:\Program Files\GIGABYTE\ET6\SF.dll
2008-05-07 15:22 - 2008-05-07 15:22 - 00102400 _____ () C:\Program Files\GIGABYTE\ET6\CIAMIB.dll
2012-01-20 16:18 - 2012-01-20 16:18 - 01478724 _____ () C:\Program Files\GIGABYTE\ET6\OCK.dll
2011-09-14 17:12 - 2011-09-14 17:12 - 00102400 _____ () C:\Program Files\GIGABYTE\ET6\ycc.dll
2010-10-19 10:59 - 2010-10-19 10:59 - 00065536 _____ () C:\Program Files\GIGABYTE\ET6\GPTT.dll
2010-06-24 15:50 - 2010-06-24 15:50 - 00094208 _____ () C:\Program Files\GIGABYTE\ET6\IccLibDll.dll
2011-03-01 19:00 - 2011-03-01 19:00 - 00126976 _____ () C:\Program Files\GIGABYTE\ET6\StabilityLib.dll
2011-10-18 09:26 - 2011-10-18 09:26 - 00024576 _____ () C:\Program Files\GIGABYTE\ET6\STT.dll
2012-03-01 09:14 - 2012-03-01 09:14 - 01335362 _____ () C:\Program Files\GIGABYTE\ET6\HM.dll
2012-04-02 13:42 - 2012-04-02 13:42 - 00192512 _____ () C:\Program Files\GIGABYTE\ET6\GVTunner.dll
2003-02-14 14:11 - 2003-02-14 14:11 - 00102400 _____ () C:\Program Files\GIGABYTE\ET6\Sound.dll
2010-06-10 15:52 - 2010-06-10 15:52 - 00110592 _____ () C:\Program Files\GIGABYTE\ET6\AMD8.dll
2010-03-12 05:40 - 2010-03-12 05:40 - 04449632 _____ () C:\Program Files\GIGABYTE\ET6\Platform.dll
2010-03-12 05:40 - 2010-03-12 05:40 - 00423256 _____ () C:\Program Files\GIGABYTE\ET6\Device.dll
2012-04-02 15:36 - 2012-04-02 15:36 - 00294912 _____ () C:\Program Files\GIGABYTE\ET6\MFCCPU.DLL
2013-12-05 10:37 - 2007-08-02 21:07 - 00034064 _____ () C:\Program Files\Common Files\Ulead Systems\AutoDetector\DetMethod.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00479160 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
2006-11-05 10:58 - 2006-11-05 10:58 - 00516096 _____ () C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
2006-11-05 10:28 - 2006-11-05 10:28 - 04587520 ____R () C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 02144104 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 07955304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00341352 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00028008 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00127336 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2014-08-12 10:28 - 2014-08-12 10:28 - 01173504 _____ () C:\Users\Bolle\AppData\Local\WSE_Astromenda\BRS\brs.exe
2009-04-28 20:33 - 2009-04-28 20:33 - 04715848 ____R () C:\Program Files\TechSmith\Snagit 9\PDFNetC.dll
2014-10-31 06:23 - 2014-10-31 06:23 - 00043008 _____ () c:\users\bolle\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpooenmu.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Bolle\AppData\Roaming\Dropbox\bin\libcef.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00264040 _____ () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2014-08-19 16:15 - 2014-08-19 16:15 - 00480256 _____ () C:\Program Files\AIMP3\sqlite3.dll
2014-08-19 16:15 - 2014-08-19 16:15 - 00220672 _____ () C:\Program Files\AIMP3\Modules\MACDll.dll
2014-08-19 16:15 - 2014-08-19 16:15 - 00155648 _____ () C:\Program Files\AIMP3\Modules\libFLAC.dll
2014-08-19 16:15 - 2014-08-19 16:15 - 01733120 _____ () C:\Program Files\AIMP3\Modules\aimp_libvorbis.dll
2014-08-19 16:15 - 2014-08-19 16:15 - 00072136 _____ () C:\Program Files\AIMP3\Plugins\aimp_lastfm.dll
2014-08-19 16:15 - 2014-08-19 16:15 - 00026624 _____ () C:\Program Files\AIMP3\Plugins\Aorta.svp
2014-08-19 16:15 - 2014-08-19 16:15 - 00237568 _____ () C:\Program Files\AIMP3\Plugins\OptimFROG.dll
2014-08-19 16:15 - 2014-08-19 16:15 - 00141768 _____ () C:\Program Files\AIMP3\Plugins\PandemicAnalogMeter.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Bolle\Documents\3dsMaxDesign:Roxio EMC Stream
AlternateDataStreams: C:\Users\Bolle\Documents\Eigene Etiketten:Roxio EMC Stream
AlternateDataStreams: C:\Users\Bolle\Documents\Inventor:Roxio EMC Stream
AlternateDataStreams: C:\Users\Bolle\Documents\Inventor Server SDK ACAD 2013:Roxio EMC Stream
AlternateDataStreams: C:\Users\Bolle\Documents\Inventor Server x86 3dsMaxDesign:Roxio EMC Stream
AlternateDataStreams: C:\Users\Bolle\Documents\Inventor Server x86 Direct Connect:Roxio EMC Stream

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-3000836441-3054148485-1156403926-500 - Administrator - Disabled)
Bolle (S-1-5-21-3000836441-3054148485-1156403926-1000 - Administrator - Enabled) => C:\Users\Bolle
Gast (S-1-5-21-3000836441-3054148485-1156403926-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (10/31/2014 06:52:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/30/2014 06:50:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/29/2014 10:34:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cm4.exe, Version: 4.0.2.21, Zeitstempel: 0x536b1e10
Name des fehlerhaften Moduls: Cabinet.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b768
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001678
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xcm4.exe0
Pfad der fehlerhaften Anwendung: cm4.exe1
Pfad des fehlerhaften Moduls: cm4.exe2
Berichtskennung: cm4.exe3

Error: (10/29/2014 07:28:20 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/28/2014 06:58:13 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/27/2014 06:46:00 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm cranimxx_handler.vshost.exe, Version 10.0.30319.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 550

Startzeit: 01cff1fbd5c6782e

Endzeit: 6

Anwendungspfad: C:\Quellkotze\cranimxx_handler_24102014_Bolle\cranimxx_handler\bin\Debug\cranimxx_handler.vshost.exe

Berichts-ID: 18c883fc-5e01-11e4-a281-1c6f65ad03de

Error: (10/27/2014 03:15:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cm5.exe, Version: 5.0.0.22, Zeitstempel: 0x53ee100f
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x1c44
Startzeit der fehlerhaften Anwendung: 0xcm5.exe0
Pfad der fehlerhaften Anwendung: cm5.exe1
Pfad des fehlerhaften Moduls: cm5.exe2
Berichtskennung: cm5.exe3

Error: (10/27/2014 03:15:01 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: cm5.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.IO.IOException
Stapel:
   bei System.IO.__Error.WinIOError(Int32, System.String)
   bei System.IO.FileStream.Init(System.String, System.IO.FileMode, System.IO.FileAccess, Int32, Boolean, System.IO.FileShare, Int32, System.IO.FileOptions, SECURITY_ATTRIBUTES, System.String, Boolean, Boolean, Boolean)
   bei System.IO.FileStream..ctor(System.String, System.IO.FileMode, System.IO.FileAccess, System.IO.FileShare)
   bei System.Xml.XmlDocument.Save(System.String)
   bei CRANE_MANAGER_V5.CRANE_MANAGER_V5.XML_class.XML_default(System.String, System.String, System.String)
   bei CRANE_MANAGER_V5.CRANE_MANAGER_V5.CM5Window.CM5Window_Loaded(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.RoutedEventHandlerInfo.InvokeHandler(System.Object, System.Windows.RoutedEventArgs)
   bei System.Windows.EventRoute.InvokeHandlersImpl(System.Object, System.Windows.RoutedEventArgs, Boolean)
   bei System.Windows.UIElement.RaiseEventImpl(System.Windows.DependencyObject, System.Windows.RoutedEventArgs)
   bei System.Windows.UIElement.RaiseEvent(System.Windows.RoutedEventArgs)
   bei System.Windows.BroadcastEventHelper.BroadcastEvent(System.Windows.DependencyObject, System.Windows.RoutedEvent)
   bei System.Windows.BroadcastEventHelper.BroadcastLoadedEvent(System.Object)
   bei MS.Internal.LoadedOrUnloadedOperation.DoWork()
   bei System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()
   bei System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks()
   bei System.Windows.Media.MediaContext.RenderMessageHandlerCore(System.Object)
   bei System.Windows.Media.MediaContext.RenderMessageHandler(System.Object)
   bei System.Windows.Media.MediaContext.Resize(System.Windows.Media.ICompositionTarget)
   bei System.Windows.Interop.HwndTarget.OnResize()
   bei System.Windows.Interop.HwndTarget.HandleMessage(MS.Internal.Interop.WindowMessage, IntPtr, IntPtr)
   bei System.Windows.Interop.HwndSource.HwndTargetFilterMessage(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.ShowWindow(System.Runtime.InteropServices.HandleRef, Int32)
   bei System.Windows.Window.ShowHelper(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.DispatcherOperation.InvokeImpl()
   bei System.Windows.Threading.DispatcherOperation.InvokeInSecurityContext(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Windows.Threading.DispatcherOperation.Invoke()
   bei System.Windows.Threading.Dispatcher.ProcessQueue()
   bei System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
   bei System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
   bei MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
   bei MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
   bei System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.PushFrame(System.Windows.Threading.DispatcherFrame)
   bei System.Windows.Threading.Dispatcher.Run()
   bei System.Windows.Application.RunDispatcher(System.Object)
   bei System.Windows.Application.RunInternal(System.Windows.Window)
   bei System.Windows.Application.Run(System.Windows.Window)
   bei CRANE_MANAGER_V5.Application.Main()

Error: (10/27/2014 03:06:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cm5.exe, Version: 5.0.0.23, Zeitstempel: 0x543f8537
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x594
Startzeit der fehlerhaften Anwendung: 0xcm5.exe0
Pfad der fehlerhaften Anwendung: cm5.exe1
Pfad des fehlerhaften Moduls: cm5.exe2
Berichtskennung: cm5.exe3

Error: (10/27/2014 03:06:33 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: cm5.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Windows.Markup.XamlParseException
Stapel:
   bei System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)
   bei System.Windows.Markup.WpfXamlLoader.LoadBaml(System.Xaml.XamlReader, Boolean, System.Object, System.Xaml.Permissions.XamlAccessLevel, System.Uri)
   bei System.Windows.Markup.XamlReader.LoadBaml(System.IO.Stream, System.Windows.Markup.ParserContext, System.Object, Boolean)
   bei System.Windows.Application.LoadComponent(System.Object, System.Uri)
   bei CRANE_MANAGER_V5.Application.InitializeComponent()
   bei CRANE_MANAGER_V5.Application.Main()


System errors:
=============
Error: (10/31/2014 06:25:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "BonanzaDealsLive-Dienst (bonanzadealslive)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/31/2014 06:23:13 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎31.‎10.‎2014 um 06:21:35 unerwartet heruntergefahren.

Error: (10/31/2014 06:20:40 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎31.‎10.‎2014 um 06:17:53 unerwartet heruntergefahren.

Error: (10/31/2014 06:07:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "BonanzaDealsLive-Dienst (bonanzadealslive)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/30/2014 07:40:09 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Apache2.2" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.

Error: (10/30/2014 07:14:25 AM) (Source: Disk) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\Harddisk2\DR2.

Error: (10/30/2014 06:23:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "BonanzaDealsLive-Dienst (bonanzadealslive)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/30/2014 06:21:21 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎30.‎10.‎2014 um 06:19:23 unerwartet heruntergefahren.

Error: (10/30/2014 06:19:23 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎30.‎10.‎2014 um 06:17:21 unerwartet heruntergefahren.

Error: (10/30/2014 06:13:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "BonanzaDealsLive-Dienst (bonanzadealslive)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-12-19 05:42:32.473
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.471
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.469
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.463
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.460
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.458
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.453
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.451
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.449
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-19 05:42:32.441
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7 CPU 870 @ 2.93GHz
Percentage of memory in use: 43%
Total physical RAM: 3543.49 MB
Available physical RAM: 1988.77 MB
Total Pagefile: 7085.27 MB
Available Pagefile: 5229.96 MB
Total Virtual: 2047.88 MB
Available Virtual: 1888.45 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.37 GB) (Free:46.47 GB) NTFS
Drive e: (OS) (Fixed) (Total:298 GB) (Free:55.51 GB) NTFS
Drive l: (Bolle-1042-01_save) (Fixed) (Total:931.51 GB) (Free:35.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 98DEB064)
Partition 1: (Not Active) - (Size=86 MB) - (Type=DE)
Partition 2: (Active) - (Size=298 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 87B31588)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 09BA6BED)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Gruß
Bolle

Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

• Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
• Klicke auf Optionen und wähle als Sprache Deutsch.
• Suche im Uninstallerfeld nach den Programmen:
  
  allday savings
  
  FLV Player
  
  WSE_Astromenda
  
  WSE_Astromenda
  
  WSE_Astromenda
  
  
  
• Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

 

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Moin,

Das einzige, was gemeldet wurde ist, daß die Anwendung zum Uninstall nicht gefunden wurde, aber die Registryeinträge konnte ich löschen.

Hier der "log.txt"

ComboFix 14-10-29.01 - Bolle 02.11.2014  19:08:15.1.8 - x86
Microsoft Windows 7 Professional N   6.1.7601.1.1252.49.1031.18.3543.1826 [GMT 1:00]
ausgeführt von:: c:\users\Bolle\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\downloaded_update.exe
c:\users\Bolle\AppData\Local\assembly\tmp
c:\windows\Downloaded Program Files\IDropPTB.dll
c:\windows\system32\html
c:\windows\system32\html\calendar.html
c:\windows\system32\html\calendarbottom.html
c:\windows\system32\html\calendartop.html
c:\windows\system32\html\crystalexportdialog.htm
c:\windows\system32\html\crystalprinthost.html
c:\windows\system32\images
c:\windows\system32\images\toolbar\calendar.gif
c:\windows\system32\images\toolbar\crlogo.gif
c:\windows\system32\images\toolbar\export.gif
c:\windows\system32\images\toolbar\export_over.gif
c:\windows\system32\images\toolbar\exportd.gif
c:\windows\system32\images\toolbar\First.gif
c:\windows\system32\images\toolbar\first_over.gif
c:\windows\system32\images\toolbar\Firstd.gif
c:\windows\system32\images\toolbar\gotopage.gif
c:\windows\system32\images\toolbar\gotopage_over.gif
c:\windows\system32\images\toolbar\gotopaged.gif
c:\windows\system32\images\toolbar\grouptree.gif
c:\windows\system32\images\toolbar\grouptree_over.gif
c:\windows\system32\images\toolbar\grouptreed.gif
c:\windows\system32\images\toolbar\grouptreepressed.gif
c:\windows\system32\images\toolbar\Last.gif
c:\windows\system32\images\toolbar\last_over.gif
c:\windows\system32\images\toolbar\Lastd.gif
c:\windows\system32\images\toolbar\Next.gif
c:\windows\system32\images\toolbar\next_over.gif
c:\windows\system32\images\toolbar\Nextd.gif
c:\windows\system32\images\toolbar\Prev.gif
c:\windows\system32\images\toolbar\prev_over.gif
c:\windows\system32\images\toolbar\Prevd.gif
c:\windows\system32\images\toolbar\print.gif
c:\windows\system32\images\toolbar\print_over.gif
c:\windows\system32\images\toolbar\printd.gif
c:\windows\system32\images\toolbar\Refresh.gif
c:\windows\system32\images\toolbar\refresh_over.gif
c:\windows\system32\images\toolbar\refreshd.gif
c:\windows\system32\images\toolbar\Search.gif
c:\windows\system32\images\toolbar\search_over.gif
c:\windows\system32\images\toolbar\searchd.gif
c:\windows\system32\images\toolbar\up.gif
c:\windows\system32\images\toolbar\up_over.gif
c:\windows\system32\images\toolbar\upd.gif
c:\windows\system32\images\tree\begindots.gif
c:\windows\system32\images\tree\beginminus.gif
c:\windows\system32\images\tree\beginplus.gif
c:\windows\system32\images\tree\blank.gif
c:\windows\system32\images\tree\blankdots.gif
c:\windows\system32\images\tree\dots.gif
c:\windows\system32\images\tree\lastdots.gif
c:\windows\system32\images\tree\lastminus.gif
c:\windows\system32\images\tree\lastplus.gif
c:\windows\system32\images\tree\Magnify.gif
c:\windows\system32\images\tree\minus.gif
c:\windows\system32\images\tree\minusbox.gif
c:\windows\system32\images\tree\plus.gif
c:\windows\system32\images\tree\plusbox.gif
c:\windows\system32\images\tree\singleminus.gif
c:\windows\system32\images\tree\singleplus.gif
c:\windows\system32\roboot.exe
c:\windows\system32\Temp
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-10-02 bis 2014-11-02  ))))))))))))))))))))))))))))))
.
.
2014-11-02 18:15 . 2014-11-02 18:15	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-11-02 17:51 . 2014-11-02 17:51	--------	d-----w-	c:\program files\VS Revo Group
2014-10-31 13:01 . 2014-10-31 13:01	--------	d-----w-	c:\program files\Hewlett-Packard
2014-10-31 13:00 . 2014-03-06 10:48	597512	------w-	c:\windows\system32\HPDiscoPM7012.dll
2014-10-31 13:00 . 2014-10-31 13:00	--------	d-----w-	c:\programdata\HP
2014-10-31 13:00 . 2014-10-31 13:01	--------	d-----w-	c:\program files\HP
2014-10-31 12:42 . 2014-10-31 13:01	--------	d-----w-	c:\users\Bolle\AppData\Local\HP
2014-10-29 13:42 . 2014-10-29 13:42	--------	d-----w-	c:\programdata\Canneverbe Limited
2014-10-29 13:42 . 2014-10-29 13:42	--------	d-----w-	c:\users\Bolle\AppData\Roaming\Canneverbe Limited
2014-10-29 13:42 . 2014-10-29 13:42	--------	d-----w-	c:\program files\CDBurnerXP
2014-10-17 16:08 . 2014-09-09 01:24	8806800	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{B071F437-D08C-4C64-B42E-F734AF9CFA7D}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-02 17:54 . 2013-12-04 23:28	24944	----a-w-	c:\windows\system32\drivers\GVTDrv.sys
2014-11-02 17:53 . 2013-12-04 23:28	17488	----a-w-	c:\windows\gdrv.sys
2014-10-27 14:10 . 2013-12-05 11:49	376832	----a-w-	c:\windows\system32\MPIWIN32.DLL
2014-10-23 08:18 . 2013-12-05 10:47	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-10-23 08:18 . 2013-12-05 10:47	701104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-09-25 01:40 . 2014-10-01 04:36	519680	----a-w-	c:\windows\system32\qdvd.dll
2014-09-15 07:06 . 2013-12-04 23:52	231568	------w-	c:\windows\system32\MpSigStub.exe
2014-09-09 21:47 . 2014-09-24 04:09	2048	----a-w-	c:\windows\system32\tzres.dll
2014-08-23 01:46 . 2014-08-27 20:24	305152	----a-w-	c:\windows\system32\gdi32.dll
2014-08-12 08:39 . 2014-08-12 08:39	243128	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912]
"BRS"="c:\users\Bolle\AppData\Local\WSE_Astromenda\BRS\brs.exe" [2014-08-12 1173504]
"HP Officejet Pro 8620 (NET)"="c:\program files\HP\HP Officejet Pro 8620\Bin\ScanToPCActivationApp.exe" [2014-03-06 2427400]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2012-01-16 10959464]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2014-03-18 373760]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2007-08-02 95504]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-12-05 356128]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2012-02-05 383424]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2012-09-12 204136]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-05-31 1634112]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1425208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"EasyTuneVI"="c:\program files\GIGABYTE\ET6\ETCall.exe" [2012-02-01 40960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2014-06-29 280576]
.
c:\users\Bolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Bolle\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-13 36414624]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Snagit 9.lnk - c:\program files\TechSmith\Snagit 9\Snagit32.exe [2009-4-28 7226696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R0 GVTDrv;GVTDrv; [x]
R2 bonanzadealslive;BonanzaDealsLive-Dienst (bonanzadealslive);c:\program files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
R3 bonanzadealslivem;BonanzaDealsLive-Dienst (bonanzadealslivem);c:\program files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2011-11-02 19056]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-08-12 243128]
S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2010-10-18 20549]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-01-31 19232]
S3 CBUSB;MARX CryptoTech LP;c:\windows\system32\drivers\CBUSB.sys [2013-12-05 45056]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
.
Inhalt des "geplante Tasks" Ordners
.
2014-11-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-05 08:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://astromenda.com/?f=1&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCyD0FtDyBzyyCyBtG0E0FtCyBtGzztAtDtDtGyBtC0CyBtGyDyCtCtAtCtAtAyDzy0B0E0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=786703565&ir=
IE: Hinzufügen zu Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: NuSphere PhpED :: Debug this page - c:\program files\NuSphere\PhpED\NuSphereIEBar.dll/1000
IE: {{c0e8ae32-0758-4c8d-ab71-23b361fe8964} - c:\users\Bolle\AppData\Local\Temp\ie_script.htm
TCP: Interfaces\{A2BCD42D-08DF-4E10-A6FB-344E3B7CDAAB}: NameServer = 10.4.71.2,10.4.71.66
.
.
------- Dateityp-Verknüpfung -------
.
.scr=AutoCADScriptFile
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
AddRemove-_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF} - c:\program files\Corel\Corel Painter Essentials 3\MSILauncher {0C180787-F8C8-42FD-A9D3-689BA44BEAAF}
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-11-02  19:16:06
ComboFix-quarantined-files.txt  2014-11-02 18:16
.
Vor Suchlauf: 16 Verzeichnis(se), 60.537.806.848 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 65.970.909.184 Bytes frei
.
- - End Of File - - A39312C60A4377D95B1B422C263B4B7B
A36C5E4F47E84449FF07ED3517B43A31
         

Der ComboFix.txt kommt gleich.

Hier nun der ComboFix.txt ...

Das scheint genau derselbe Text zu sein - den kann ich mir dann sicherlich sparen.

Gruß

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Moin,

Das Ergebnis von Malwarebytes Anti-Malware

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 04.11.2014
Suchlauf-Zeit: 10:21:19
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.11.04.02
Rootkit Datenbank: v2014.11.01.02
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Bolle

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 374288
Verstrichene Zeit: 4 Min, 58 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 37
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\APPID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}, In Quarantäne, [c8fac86fe894979f558a18ced131af51], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}, In Quarantäne, [932f41f6f5871a1c3ca45393ac56f709], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, In Quarantäne, [932f41f6f5871a1c3ca45393ac56f709], 
PUP.Optional.BonanzaDeals.A, HKLM\SOFTWARE\CLASSES\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}, In Quarantäne, [d5ed43f4a0dc65d1e2a5bf295ea408f8], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{FBC322D5-407E-4854-8C0B-555B951FD8E3}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{0400EBCA-042C-4000-AA89-9713FBEDB671}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{0BD19251-4B4B-4B94-AB16-617106245BB7}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{44B29DDD-CF7A-454A-A275-A322A398D93F}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B2DB115C-8278-4947-9A07-57B53D1C4215}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B97FC455-DB33-431D-84DB-6F1514110BD5}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E72E9312-0367-4216-BFC7-21485FA8390B}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}, In Quarantäne, [e7db77c02b5162d4bc892bbc2dd53dc3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}, In Quarantäne, [1ea49b9c1f5d7bbb83135c8a837f817f], 
PUP.Optional.BonanzaDeals.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{33BAF587-9647-4281-A34F-F4830CDC1B9F}, In Quarantäne, [576b15224c309c9acbaf23c50af8867a], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}, In Quarantäne, [18aa6acd3a425dd9bc5e687f54aef808], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}, In Quarantäne, [cef4b4832e4e48eed64544a320e22dd3], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, In Quarantäne, [3092cc6bc9b3cb6b01968825af53b44c], 
PUP.Optional.BonanzaDeals.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}, In Quarantäne, [c9f99c9b06769c9a6019ac3caf533cc4], 
PUP.Optional.BonanzaDeals.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C4BEF720-313C-420A-ACF6-77DD95D8F553}, In Quarantäne, [863cc0774b311620b8ca9e4a59a933cd], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\Iminent, In Quarantäne, [2c9665d2dca0c5716375095bc24114ec], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\CLASSES\Iminent, In Quarantäne, [6c560037c3b9ad89a86bdfb09f658c74], 
PUP.Optional.InstallCore.A, HKLM\SOFTWARE\INSTALLCORE\WSE_Astromenda, In Quarantäne, [9c26a2958eeeb97d84cf9696a55ebb45], 
PUP.Optional.BonanzaDeals.A, HKLM\SOFTWARE\MOZILLAPLUGINS\@tools.bdupdater.com/BonanzaDealsLive Update;version=3, In Quarantäne, [734f9e994636cf6730026a1862a28977], 
PUP.Optional.BonanzaDeals.A, HKLM\SOFTWARE\MOZILLAPLUGINS\@tools.bdupdater.com/BonanzaDealsLive Update;version=9, In Quarantäne, [7f431423bcc0a98d30027e0415ef7a86], 
PUP.Optional.SystemSpeedup, HKLM\SOFTWARE\SYSTWEAK\ssd, In Quarantäne, [0db55ed93745f83efbd26ed0a95a4db3], 
PUP.Optional.BonanzaDeals.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\bonanzadealslive, In Quarantäne, [9d25ba7d106c46f04be8c6bc5ea6f60a], 
PUP.Optional.BonanzaDeals.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\bonanzadealslivem, In Quarantäne, [2a9875c2f08c53e3fa397f03d3314eb2], 
PUP.Optional.Astromenda.A, HKU\S-1-5-21-3000836441-3054148485-1156403926-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WSE_Astromenda, In Quarantäne, [bd05ed4a18648da9024cc86c7c87b749], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-3000836441-3054148485-1156403926-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [ba08c671007c53e37b6c51124cb726da], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-3000836441-3054148485-1156403926-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [a31fef48324a5adcf72f98e2cf353bc5], 
PUP.Optional.SystemSpeedup, HKU\S-1-5-21-3000836441-3054148485-1156403926-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\ssd, In Quarantäne, [bf030433f18b0135933981bdc34002fe], 

Registrierungswerte: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-3000836441-3054148485-1156403926-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, zr2Y1E2Z1G1J1T1M, In Quarantäne, [a31fef48324a5adcf72f98e2cf353bc5]

Registrierungsdaten: 1
PUP.Optional.Astromenda.A, HKU\S-1-5-21-3000836441-3054148485-1156403926-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://astromenda.com/?f=1&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCyD0FtDyBzyyCyBtG0E0FtCyBtGzztAtDtDtGyBtC0CyBtGyDyCtCtAtCtAtAyDzy0B0E0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=786703565&ir=, Gut: (www.google.com), Schlecht: (hxxp://astromenda.com/?f=1&a=ast_dnldstr_14_50_ff&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SzyyDyEtN1L2XzutBtFtBtCtFtCzztFyBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StCyD0FtDyBzyyCyBtG0E0FtCyBtGzztAtDtDtGyBtC0CyBtGyDyCtCtAtCtAtAyDzy0B0E0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SzytDyCyE0FtAyEzztG0C0Dzz0AtGyE0AyB0AtG0ByCyCtAtGyCyD0ByDzy0D0F0ByBtByD0D2Q&cr=786703565&ir=),Ersetzt,[cbf78cab0973ca6c8ec52f0c45c01ae6]

Ordner: 25
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\index-dir, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\databases, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\GPUCache, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\IndexedDB, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Local Storage, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.OpenCandy, C:\Users\Bolle\AppData\Roaming\OpenCandy, In Quarantäne, [9e24e354413bcc6a91d9a4568c762bd5], 
PUP.Optional.OpenCandy, C:\Users\Bolle\AppData\Roaming\OpenCandy\2F4A2257A4F24917BF7AD88F11BF5D62, In Quarantäne, [9e24e354413bcc6a91d9a4568c762bd5], 
PUP.Optional.SystemSpeedup, C:\Users\Bolle\AppData\Roaming\Systweak\ssd, In Quarantäne, [bd052e090b71053139bbcf4342c1936d], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\Astromenda, In Quarantäne, [259df93e0379d4622bf3aa7139ca4cb4], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\Astromenda\BRS, In Quarantäne, [259df93e0379d4622bf3aa7139ca4cb4], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\bh, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\BRS, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\icons_3.0.10.2, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\Adobe AIR, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\Adobe AIR\Versions, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\Adobe AIR\Versions\1.0, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\META-INF, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\META-INF\AIR, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 

Dateien: 113
PUP.Optional.Freemium.A, C:\Users\Bolle\Downloads\Media-Player.exe, In Quarantäne, [7e444fe8c3b91c1a055ff34b6e93718f], 
PUP.Optional.RegCleanerPro, C:\Windows\System32\Tasks\ASP, In Quarantäne, [bf0323141e5ec86e60c461d6877c9b65], 
PUP.Optional.Adpeak.A, C:\Program Files\005\vulsrsebjh32.exe, In Quarantäne, [c20084b346361d1938d257e454afcf31], 
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Local\mysearchdial-speeddial.crx, In Quarantäne, [289ae156a8d4f2449d8580bec2418d73], 
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\searchplugins\Mysearchdial.xml, In Quarantäne, [01c12b0c84f85cda23a2085155aed62a], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\QuotaManager-journal, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\cookies, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\cookies-journal, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\QuotaManager, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\website.ico, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\07d2ceb8057382e2_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\315a39b606bc4359_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\327e2f346370c855_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\37777592bb84fb04_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\47cff2ba15008159_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\49aed1ef9e352033_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\77598e62f86163fb_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\8a2abd4eed83e9d6_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\a682a844981d4e40_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\ee45053f10a52455_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\f69da27520847370_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\index, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\Cache\index-dir\the-real-index, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\databases\Databases.db, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\databases\Databases.db-journal, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\GPUCache\data_0, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\GPUCache\data_1, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\GPUCache\data_2, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\GPUCache\data_3, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\GPUCache\index, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\000003.log, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\CURRENT, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOCK, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\LOG, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.Gameo.A, C:\Users\Bolle\AppData\Local\Gameo\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000002, In Quarantäne, [596960d73b419b9b961f8015d52fef11], 
PUP.Optional.MySpeedDial.A, C:\Users\Bolle\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage, In Quarantäne, [9131b186c9b30b2be55d3363699ba45c], 
PUP.Optional.OpenCandy, C:\Users\Bolle\AppData\Roaming\OpenCandy\2F4A2257A4F24917BF7AD88F11BF5D62\SkypeSetupFull-6.18.0.106.exe, In Quarantäne, [9e24e354413bcc6a91d9a4568c762bd5], 
PUP.Optional.SystemSpeedup, C:\Users\Bolle\AppData\Roaming\Systweak\ssd\SSDPTstub.exe, In Quarantäne, [bd052e090b71053139bbcf4342c1936d], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\Astromenda\BRS\stats, In Quarantäne, [259df93e0379d4622bf3aa7139ca4cb4], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\FavIcon.ico, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\Sqlite3.dll, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\uninst.dat, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\uninstall.exe, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\BRS\brs.exe, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\BRS\Sqlite3.dll, In Quarantäne, [bb0753e42b51fb3b440dd845cb386a96], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\icons_3.0.10.2\ctr.ico, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\bkup.dat, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\config.dat, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\info.dat, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\STTL.DAT, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\TTL.DAT, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.Astromenda.A, C:\Users\Bolle\AppData\Roaming\WSE_Astromenda\UpdateProc\UpdateTask.exe, In Quarantäne, [368cb2854c30b680dd8de63705fe59a7], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\FLVMPlayer.exe, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\FLVMPlayer.swf, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\mimetype, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\Uninstaller.exe, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\Adobe AIR\Versions\1.0\Adobe AIR.dll, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\META-INF\AIR\application.xml, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.FLVMPlayer, C:\Program Files\FLVM Player\META-INF\AIR\signatures.xml, In Quarantäne, [15ad50e7126ad26445402df146bd16ea], 
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.mysearchdial.aflt", "irmsd1103");), Ersetzt,[d4ee2a0d87f5e5517e0f175872932dd3]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ces

/* Do not edit this file.
 *
 * If you make changes to this file while the a), Ersetzt,[a41e181f6517ee48513cff70798ca858]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (e.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To mak), Ersetzt,[b50db7805c2076c01c71c1aee32228d8]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (nning,
 * the changes will be overwritten when the a), Ersetzt,[11b1e057b8c42e08c3caa1ced0357987]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ences

/* Do not edit this file.
 *
 * If you), Ersetzt,[bd052215dca068ce08854e2108fd1fe1]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (eferences

/* Do not edit this file.
 *
 * If yo), Ersetzt,[517121164f2db97dbdd0224d5ca9b34d]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (rences

/* Do not edit this file.
 *
 * If you), Ersetzt,[30920235255738fe9fee3a35877eda26]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ferences

/* Do not edit this file.
 *
 * If you), Ersetzt,[20a248ef522a05316627e38c9c69cc34]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (rences

/* Do not edit this file.
 *
 * If y), Ersetzt,[3b872017f18ba096f499145b3bca1de3]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (references

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, y), Ersetzt,[992945f2d7a5e6503558412e3acb2cd4]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: ( *
 * To make a manual change to preferences, you can visit), Ersetzt,[3989fa3d13694ee816772b442bda1ee2]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
 *
 * If you make changes), Ersetzt,[853def48afcd65d1a0ed88e707feae52]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ces

/* Do not edit this file.
 *
 * If you ma), Ersetzt,[dae89a9d1a62c670f59881ee887d5ea2]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ferences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you c), Ersetzt,[6c5610275e1ed6606726323dbe47fa06]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (
 * To make a manual change to preferences, you can visit ), Ersetzt,[15adbf785923d85e1b72a4cb9e673dc3]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (

/* Do not edit this file.
 *
 * If you make changes to t), Ersetzt,[dde5d265bdbf94a2a1ecea85b352857b]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
 *
 * If you make changes to this ), Ersetzt,[3191181f057776c0d0bdb6b94bba4eb2]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (* Do not edit this file.
 *
 * If you make changes), Ersetzt,[7b4748efd8a462d4bdd00b64b84d11ef]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (rences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visi), Ersetzt,[0cb6191e3a42ed499df0afc0976eda26]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (To make a manual change to preferences, you can visit ), Ersetzt,[4d75092ed1ab2f070c81195636cfe020]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (nces

/* Do not edit this file.
 *
 * If you make c), Ersetzt,[bc0676c1f08c48ee0e7fff70b550d42c]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ferences

/* Do not edit this file.
 *
 * If you ), Ersetzt,[447e71c6fb814cea820bc6a9f11408f8]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ences

/* Do not edit this file.
 *
 * If you make ), Ersetzt,[f2d07abd9edea88edbb2ff70877e2dd3]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\prefs.js, Gut: (), Schlecht: (ces

/* Do not edit this file.
 *
 * If you make changes to t), Ersetzt,[5d65ac8bc7b52b0b2a63204fb15421df]
PUP.Optional.MySearch.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (user_pref("extensions.irmysearch.aflt", "irmsd1103");), Ersetzt,[04be340380fcc76f9de83d320ff63dc3]
PUP.Optional.MySearch.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions), Ersetzt,[913186b16a1253e31e6774fb26df7090]
PUP.Optional.MySearch.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ons.mysearchdial.hmpg", true);
user_pref("extensio), Ersetzt,[8a3824135626d660a0e590dffd0858a8]
PUP.Optional.MySearch.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0), Ersetzt,[06bc3ef95428fb3bd4b1fb746e9707f9]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (user_pref("extensions.mysearchdial.hmpg", true);), Ersetzt,[cff388af5a22e155810d3b340005e61a]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (sions.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L), Ersetzt,[972b3601b1cbd462c0ce48270ff6c13f]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu), Ersetzt,[cdf57fb8d6a6d6607f0f8be4f2138b75]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (s.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdia), Ersetzt,[685ab87fe795c96d4a44b6b9709537c9]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ial.hmpg", true);
user_pref("extensions.mysearchd), Ersetzt,[01c1eb4c087470c6088699d6b35202fe]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ons.mysearchdial.hmpg", true);
user_pref("extensions), Ersetzt,[c9f9e94e94e883b3a5e9541b5ca904fc]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCy), Ersetzt,[4082c473dba116207e10521d63a2ca36]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=289058922&ir=");
user_pref("extensions.mysearchdial.dfltSrch", true);
user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
user_pref("extensions.mysearchdial), Ersetzt,[883a55e299e3cc6a9cf24b245aabb64a]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=2), Ersetzt,[566cf641cdaf49eddab4452a44c10bf5]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (chdial.hmpg", true);
user_pref("extensions.mysearchdia), Ersetzt,[279b26111e5eb680d1bda2cd937212ee]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions.mysea), Ersetzt,[a02270c70c7080b6d8b6c6a9986d768a]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (mysearchdial.hmpg", true);
user_pref("extensions.mysea), Ersetzt,[3092ec4bef8d2f0779154926887db749]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmp), Ersetzt,[8a38fa3da4d886b0f59906699372b54b]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (l.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl",), Ersetzt,[d8ead364e7954ee82e601b54d92c639d]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (hdial.hmpg", true);
user_pref("extensions.mysearchdial.hmp), Ersetzt,[9a285cdb16667bbb5b33541be71e51af]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (rchdial.hmpg", true);
user_pref("extensions.mysearchdi), Ersetzt,[71514dea3844af87820ca6c917ee6a96]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions.mysear), Ersetzt,[9929fc3bc7b55adc6d218de24db848b8]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions.mys), Ersetzt,[fdc5a790225a74c2573717587a8b9e62]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (s.mysearchdial.hmpg", true);
user_pref("extension), Ersetzt,[0fb353e4374530068e0090dfff06cc34]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ons.mysearchdial.hmpg", true);
user_pref("extens), Ersetzt,[2b971027a6d6a294aae4ea85d2333dc3]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (ions.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "http:/), Ersetzt,[0bb7092e4735fb3ba8e6383746bf8b75]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (r_pref("extensions.mysearchdial.hmpgUrl", "hxxp://st), Ersetzt,[13afa592b0cc73c35935b7b84fb6f50b]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0), Ersetzt,[734f1e190c702511b1dd254af510718f]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=289058922&ir=");), Ersetzt,[3a88aa8db1cb49edeea1a1ce20e53cc4]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: ("Mysearchdial");
user_pref("extensions.mysearchdial.dnsErr", true);
user_pref("extensions.mysearchdial_i.newTab", false);
user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=irmsd1103&cd=2XzuyEt), Ersetzt,[1aa8c86fafcd59dd2b642e4160a5ce32]
PUP.Optional.MySearchDial.A, C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js, Gut: (), Schlecht: (Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=289058922&ir=");
user_pref("extensions.mysearchdial.dfltSrch", true);
user_pref("extensions.mysearchdial.srchPrvdr", "Mysearch), Ersetzt,[30926ec93a420531c2cd630c0203d729]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

Das vom AwdCleaner

# AdwCleaner v4.002 - Bericht erstellt am 04/11/2014 um 10:38:44
# DB v2014-11-02.1
# Aktualisiert 27/10/2014 von Xplode
# Betriebssystem : Windows 7 Professional N Service Pack 1 (32 bits)
# Benutzername : Bolle - NEILARMSTRONG
# Gestartet von : C:\Users\Bolle\Desktop\AdwCleaner_4.002.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Bolle\AppData\Local\Astromenda
Ordner Gelöscht : C:\Users\Bolle\AppData\Roaming\Gameo
Ordner Gelöscht : C:\Users\Bolle\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Bolle\AppData\Local\wse_astromenda
Datei Gelöscht : C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\user.js

***** [ Tasks ] *****

Task Gelöscht : ASP
Task Gelöscht : BonanzaDealsUpdate

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [BRS]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4ED063C9-4A0B-4B44-A9DC-23AFF424A0D3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82E74373-58AB-47EB-B0F0-A1D82BB8EB5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C358B3D0-B911-41E3-A276-E7D43A6BA56D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{13086CD4-88B6-45E3-9182-3BC2664199F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1FCD7139-C2A3-49AD-8B9E-E82E48AE5DF6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{319FCB76-1568-4EFA-863B-B03A2B16EB5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4796719D-2B92-47BC-920B-77BCDBDBCB6A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64A66B25-A70F-4373-95EF-3A1DB6040B3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6FC5F7E0-D65A-465C-B8EE-A5F8E008D6DF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{731D436C-464C-4F29-BFB2-DE9C458535AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7C89C8A6-991C-4626-9E26-B12EB4D89C04}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEF00686-CAB8-4885-9CCB-78FF483041AA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FDA55C78-736E-4E8A-996C-4A80FC0396FB}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}
Schlüssel Gelöscht : HKCU\Software\BRS
Schlüssel Gelöscht : HKCU\Software\ClickConnect
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\InstallCore
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CSEHTMLVALIDATORLITE110_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v

[u743yc74.default] - Zeile gelöscht : user_pref("extensions.irmysearch.aflt", "irmsd1103");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.irmysearch.cr", "289058922");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.irmysearch.instlRef", "");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.cr", "289058922");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.dfltLng", "");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.dfltSrch", true);
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.dnsErr", true);
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.excTlbr", false);
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.hmpg", true);
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutC[...]
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.id", "1C6F65AD03DE771C");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.instlDay", "16044");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.instlRef", "");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu[...]
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.prdct", "mysearchdial");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.tlbrId", "base");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=irmsd1103&cd=2XzuyEtN2Y1L1QzutC0CyC0FyCyD0A0DtDtA0D0EyByBtC0CtN0D0Tzu0SyBtDyEtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1C[...]
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.vrsn", "1.8.21.0");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial.vrsni", "1.8.21.0");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial_i.hmpg", true);
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial_i.newTab", false);
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial_i.smplGrp", "none");
[u743yc74.default] - Zeile gelöscht : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.21.01:55:35");
[u743yc74.default] - Zeile gelöscht : user_pref("iminent.BirthDate", "1407843255");

-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [7326 octets] - [04/11/2014 10:37:01]
AdwCleaner[S0].txt - [7239 octets] - [04/11/2014 10:38:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7299 octets] ##########
         

... und nun noch der JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.5 (10.31.2014:1)
OS: Windows 7 Professional N x86
Ran by Bolle on 04.11.2014 at 10:47:16,56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files\005"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.11.2014 at 10:48:37,95
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Irgendwo war mir Bonanzadeals aufgefallen - das hatte ich schon mal vor einiger Zeit entfernt. Es könnte vielleicht sein, daß sich das von einer Datensicherung wieder eingeschlichen hat, denn sonst kann ich mir ein Problem kaum vorstellen. Ich besuche keine einschlägigen Seiten...
Mein erster Eindruck ist mittlerweile schon wieder recht gut, aber ich warte lieber mal auf Deine Antwort.

jedenfalls noch mal Danke!

Gruß
Bolle

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Moin,

ESET hat folgendes geloggt:

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=176aa9f92d76334ca261fdc859381832
# engine=20939
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-11-05 01:29:40
# local_time=2014-11-05 02:29:40 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1291 16777213 100 99 27750 69960502 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 99539 166825371 0 0
# scanned=2689174
# found=11
# cleaned=11
# scan_time=14085
sh=FD5DDF8E6D42659758F1DE47C172AF48C184B740 ft=1 fh=c71c00114d66f49a vn="Variante von Win32/AdWare.Agent.NNW Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Bolle\AppData\Local\wse_astromenda\BRS\brs.exe.vir"
sh=E1A2C9DA921D9DA917ADE37B872D97E732A138BD ft=1 fh=a4119be6dfe53dd8 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Windows\System32\roboot.exe.vir"
sh=694075D171780AA30DC22675669CFECCF7367FF6 ft=1 fh=56099a08bd4afc01 vn="Win32/WinloadSDA.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bolle\Downloads\QR-Code-Generator-lnstall.exe"
sh=534014BF930CBD7A5869DE55867DB3292FBFAD51 ft=1 fh=85ec41928ab3cd5e vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Bolle\Downloads\Skype_Setup.exe"
sh=187D7CB8543C129847DDD2CC6066CADF04F83E0C ft=1 fh=3d6e9b7ab2a7136e vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="E:\Programme\Conduit\Community Alerts\Alert.dll"
sh=297834C3BA7DDC4ED4662C56468655B25C7B0D62 ft=1 fh=c7091104e653332e vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="E:\Programme\softonic-de3\tbsof1.dll"
sh=4B75623989A8B915F9065F9EE196516E3C7C5619 ft=1 fh=256fc33b8da1e7b7 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="E:\Programme\softonic-de3\tbsoft.dll"
sh=E750C443A83F9B135B499E7917C5A93120384BB3 ft=1 fh=4eedbac881d1fc72 vn="Win32/DownWare.L evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="L:\Fun\GRW2\Schritt1\DTLite4491-0356.exe"
sh=975AAE0DDEA99062AB53B9D8E52100FE2B679867 ft=1 fh=e1e4f1084ed9a065 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="L:\Tools\Ashampoo Burning Studio 10.0.15 Multilanguage Inkl.German\Ashampoo Burning Studio v10.0.15\ashampoo_burning_studio_10_10.0.15_sm.exe"
sh=DB15D584211EA794EDAD3C97AD6E42F6AFCD1E9C ft=1 fh=fcd5a3e13c1940f6 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="L:\Tools\Ashampoo.Burning.Studio.v11.0.4.Final\ashampoo_burning_studio_11_e11.0.4_sm.exe"
sh=D4F4C1D6EA54748F6264A03141023A5D6E10FFDD ft=1 fh=41a7a9bb02cfc2ba vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="L:\Tools\Xilisoft PDF to EPUB Converter1.0.4.0124\x-pdf-to-epub-converter.exe"
         

... es gab noch Funde.

Hier noch der FRST.txt:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-11-2014
Ran by Bolle (administrator) on NEILARMSTRONG on 05-11-2014 14:58:15
Running from C:\Users\Bolle\Desktop
Loaded Profile: Bolle (Available profiles: Bolle)
Platform: Microsoft Windows 7 Professional N  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi.exe
(Apache Software Foundation) C:\xampp\apache\bin\httpd.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Program Files\Autodesk\3ds Max Design 2013\NVIDIA\raysat_3dsmax2013_32server.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
() C:\xampp\mysql\bin\mysqld.exe
() C:\Windows\System32\PSIService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Apache Software Foundation) C:\xampp\apache\bin\httpd.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
() C:\Program Files\GIGABYTE\ET6\GUI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
(Sonic Solutions) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8620\Bin\ScanToPCActivationApp.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\Snagit32.exe
(Dropbox, Inc.) C:\Users\Bolle\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8620\Bin\HPNetworkCommunicatorCom.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\TscHelp.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\SnagPriv.exe
(Sonic Solutions) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
(TechSmith Corporation) C:\Program Files\TechSmith\Snagit 9\SnagitEditor.exe
(AIMP DevTeam) C:\Program Files\AIMP3\AIMP3.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Users\Bolle\Documents\Firefox Browser\App\Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\devenv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Quellkotze\Einleser 2011 Stand 04.11.2014_Bolle\Einleser 2011\bin\Release\Einleser 2011.vshost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(MySQL AB) C:\Program Files\MySQL\MySQL Query Browser 1.1\MySQLQueryBrowser.exe
(Microsoft Corporation) C:\Quellkotze\Einleser 2011 Stand 04.11.2014_Bolle\Einleser 2011\bin\Release\Einleser 2011.vshost.exe
(Microsoft Corporation) C:\Quellkotze\Einleser 2011 Stand 04.11.2014_Bolle\Einleser 2011\bin\Release\Einleser 2011.vshost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10959464 2012-01-16] (Realtek Semiconductor)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [FreePDF Assistant] => C:\Program Files\FreePDF_XP\fpassist.exe [373760 2014-03-18] (shbox.de)
HKLM\...\Run: [Ulead AutoDetector v2] => C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe [95504 2007-08-02] (Ulead Systems, Inc.)
HKLM\...\Run: [AVP] => C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-12-05] (Kaspersky Lab ZAO)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [ISUSPM Startup] => C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [221184 2006-10-03] (Macrovision Corporation)
HKLM\...\Run: [ISUSScheduler] => C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2006-10-03] (Macrovision Corporation)
HKLM\...\Run: [RoxWatchTray] => C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [221184 2006-11-05] (Sonic Solutions)
HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [383424 2012-02-05] (Autodesk, Inc.)
HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [1634112 2012-05-31] ()
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\RunOnce: [EasyTuneVI] => C:\Program Files\GIGABYTE\ET6\ETCall.exe [40960 2012-02-01] ()
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\Run: [HP Officejet Pro 8620 (NET)] => C:\Program Files\HP\HP Officejet Pro 8620\Bin\ScanToPCActivationApp.exe [2427400 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\...\Policies\Explorer: [] 
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-06-29] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snagit 9.lnk
ShortcutTarget: Snagit 9.lnk -> C:\Program Files\TechSmith\Snagit 9\Snagit32.exe (TechSmith Corporation)
Startup: C:\Users\Bolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Bolle\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bolle\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [Symbol-Overlay-Steuerprogramm für AutoCAD Digitale Signaturen] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC744E9914BF1CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3000836441-3054148485-1156403926-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKCU - {B065DB9C-E3E7-4086-A300-3635B72078D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV
SearchScopes: HKCU - {DE62F315-7861-4428-9EDC-3D36B94836FD} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLBR1&pc=SPLH
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM - NuSphere Debugger ToolBar - {0F62D223-9206-4EA3-9EA8-D0F3C7C82ACA} - C:\Program Files\NuSphere\PhpED\NuSphereIEBar.dll ()
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\..\Interfaces\{A2BCD42D-08DF-4E10-A6FB-344E3B7CDAAB}: [NameServer] 10.4.71.2,10.4.71.66

FireFox:
========
FF ProfilePath: C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50826.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Bolle\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-04-04]
FF Extension: Adblock Plus - C:\Users\Bolle\AppData\Roaming\Mozilla\Firefox\Profiles\u743yc74.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-04]
FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013-12-05]
FF HKLM\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013-12-05]
FF StartMenuInternet: FIREFOX.EXE - C:\Users\Bolle\Documents\Firefox Browser\App\Firefox\firefox.exe

Chrome: 
=======
CHR Profile: C:\Users\Bolle\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx [2012-10-25]
CHR HKLM\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh [2012-10-25]
CHR HKLM\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Bolle\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-08-01]
CHR HKLM\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx [2012-10-25]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apache2.2; c:\xampp\apache\bin\httpd.exe [20549 2010-10-18] (Apache Software Foundation) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-12-05] (Kaspersky Lab ZAO)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2013-12-19] (Flexera Software, Inc.)
S3 ICCS; C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 mi-raysat_3dsmax2013_32; C:\Program Files\Autodesk\3ds Max Design 2013\NVIDIA\raysat_3dsmax2013_32server.exe [86016 2011-09-15] () [File not signed]
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe [3004416 2007-11-07] (Microsoft Corporation)
R2 mysql; c:\xampp\mysql\bin\mysqld.exe [8133120 2010-12-03] () [File not signed]
R2 NVWMI; C:\Windows\system32\nvwmi.exe [2058184 2014-03-20] ()
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [174656 2006-11-02] () [File not signed]
S3 RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [880640 2006-11-05] (Sonic Solutions) [File not signed]
S2 RoxWatch9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [159744 2006-11-05] (Sonic Solutions) [File not signed]
S3 stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [73728 2006-09-14] (MicroVision Development, Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [19056 2011-11-02] ()
R3 CBUSB; C:\Windows\System32\drivers\CBUSB.sys [45056 2013-12-05] (MARX CryptoTech LP)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-08-12] (Disc Soft Ltd)
R3 gdrv; C:\Windows\gdrv.sys [17488 2014-11-05] (Windows (R) 2000 DDK provider)
R3 GVTDrv; C:\Windows\system32\Drivers\GVTDrv.sys [24944 2014-11-05] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2013-12-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [597600 2014-05-20] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-12-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25696 2013-12-05] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-12-05] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [44000 2013-12-05] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145040 2013-12-05] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-11-05] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation)
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [36528 2006-07-24] (Sonic Solutions) [File not signed]
S3 catchme; \??\C:\Users\Bolle\AppData\Local\Temp\catchme.sys [X]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [74848 2014-05-20] (Kaspersky Lab ZAO)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-05 14:58 - 2014-11-05 14:58 - 01106432 _____ (Farbar) C:\Users\Bolle\Desktop\FRST.exe
2014-11-05 14:58 - 2014-11-05 14:58 - 00000000 ____D () C:\Users\Bolle\Desktop\FRST-OlderVersion
2014-11-05 10:33 - 2014-11-05 10:33 - 00000000 ____D () C:\Program Files\ESET
2014-11-05 10:31 - 2014-11-05 10:31 - 02347384 _____ (ESET) C:\Users\Bolle\Downloads\esetsmartinstaller_deu.exe
2014-11-04 11:50 - 2014-11-04 11:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elcomsoft Password Recovery
2014-11-04 11:50 - 2014-11-04 11:50 - 00000000 ____D () C:\ProgramData\Elcomsoft Password Recovery
2014-11-04 11:50 - 2014-11-04 11:50 - 00000000 ____D () C:\Program Files\Elcomsoft Password Recovery
2014-11-04 11:50 - 2014-11-04 11:50 - 00000000 ____D () C:\Program Files\Elcomsoft
2014-11-04 10:48 - 2014-11-04 10:48 - 00000684 _____ () C:\Users\Bolle\Desktop\JRT.txt
2014-11-04 10:36 - 2014-11-04 10:38 - 00000000 ____D () C:\AdwCleaner
2014-11-04 10:32 - 2014-11-04 10:32 - 00033882 _____ () C:\Users\Bolle\Desktop\mbam.txt
2014-11-04 10:19 - 2014-11-05 12:38 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-04 10:19 - 2014-11-04 10:19 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-04 10:19 - 2014-11-04 10:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-04 10:19 - 2014-11-04 10:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-04 10:19 - 2014-11-04 10:19 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-11-04 10:19 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-04 10:19 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-04 10:19 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-04 10:13 - 2014-11-04 10:13 - 01706359 _____ (Thisisu) C:\Users\Bolle\Desktop\JRT(1).exe
2014-11-04 10:12 - 2014-11-04 10:12 - 01998336 _____ () C:\Users\Bolle\Desktop\AdwCleaner_4.002.exe
2014-11-04 10:11 - 2014-11-04 10:11 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Bolle\Desktop\mbam-setup-2.0.3.1025.exe
2014-11-03 17:35 - 2014-11-05 06:48 - 00000004 _____ () C:\Windows\system32\GVTunner.ref
2014-11-02 19:16 - 2014-11-02 19:16 - 00012813 _____ () C:\ComboFix.txt
2014-11-02 19:07 - 2014-11-02 19:16 - 00000000 ____D () C:\Qoobox
2014-11-02 19:07 - 2014-11-02 19:15 - 00000000 ____D () C:\Windows\erdnt
2014-11-02 19:07 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-11-02 19:07 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-11-02 19:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-11-02 19:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-11-02 19:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-11-02 19:07 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-11-02 19:07 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-11-02 19:07 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-11-02 19:05 - 2014-11-02 19:05 - 05591672 ____R (Swearware) C:\Users\Bolle\Desktop\ComboFix.exe
2014-11-02 19:05 - 2014-11-02 19:05 - 05591672 _____ (Swearware) C:\Users\Bolle\Downloads\ComboFix.exe
2014-11-02 18:51 - 2014-11-02 18:51 - 00001226 _____ () C:\Users\Bolle\Desktop\Revo Uninstaller.lnk
2014-11-02 18:51 - 2014-11-02 18:51 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-11-02 18:50 - 2014-11-02 18:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Bolle\Downloads\revosetup95.exe
2014-10-31 14:01 - 2014-10-31 14:01 - 00000000 ____D () C:\Program Files\Hewlett-Packard
2014-10-31 14:00 - 2014-10-31 14:01 - 00000000 ____D () C:\Program Files\HP
2014-10-31 14:00 - 2014-10-31 14:00 - 00002200 _____ () C:\Users\Public\Desktop\HP Officejet Pro 8620.lnk
2014-10-31 14:00 - 2014-10-31 14:00 - 00001152 _____ () C:\Users\Public\Desktop\Shop für Zubehör - HP Officejet Pro 8620.lnk
2014-10-31 14:00 - 2014-10-31 14:00 - 00000942 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
2014-10-31 14:00 - 2014-10-31 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-10-31 14:00 - 2014-10-31 14:00 - 00000000 ____D () C:\ProgramData\HP
2014-10-31 14:00 - 2014-03-06 11:48 - 00597512 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM7012.dll
2014-10-31 13:57 - 2014-10-31 13:57 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-10-31 13:42 - 2014-10-31 14:01 - 00000000 ____D () C:\Users\Bolle\AppData\Local\HP
2014-10-31 10:14 - 2014-11-05 14:58 - 00020614 _____ () C:\Users\Bolle\Desktop\FRST.txt
2014-10-31 10:14 - 2014-10-31 10:15 - 00085037 _____ () C:\Users\Bolle\Desktop\Addition.txt
2014-10-31 10:12 - 2014-10-31 10:12 - 01105408 _____ (Farbar) C:\Users\Bolle\Downloads\FRST(1).exe
2014-10-31 10:07 - 2014-10-31 10:07 - 00262144 _____ () C:\Windows\system32\config\elam
2014-10-30 18:21 - 2014-10-30 19:39 - 00040290 _____ () C:\Users\Bolle\Documents\P016001.dwg
2014-10-30 18:09 - 2014-10-30 18:09 - 00003701 _____ () C:\Users\Bolle\Documents\P016001.DXF
2014-10-29 14:42 - 2014-10-29 14:42 - 00001849 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-10-29 14:42 - 2014-10-29 14:42 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Canneverbe Limited
2014-10-29 14:42 - 2014-10-29 14:42 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-10-29 14:42 - 2014-10-29 14:42 - 00000000 ____D () C:\Program Files\CDBurnerXP
2014-10-29 06:45 - 2014-10-29 06:45 - 00210336 _____ () C:\Windows\Minidump\102914-10732-01.dmp
2014-10-28 20:42 - 2014-10-28 20:42 - 06126536 _____ (Tim Kosse) C:\Users\Bolle\Downloads\FileZilla_3.9.0.6_win32-setup.exe
2014-10-28 11:07 - 2014-10-28 11:08 - 10575872 _____ () C:\Users\Bolle\Documents\Database3.accdb
2014-10-27 12:35 - 2014-10-27 12:35 - 00171992 _____ () C:\Windows\Minidump\102714-11185-01.dmp
2014-10-22 09:25 - 2014-10-22 09:25 - 00054074 _____ () C:\Users\Bolle\Documents\Playlist_24.aimppl
2014-10-21 09:55 - 2014-10-21 16:22 - 00051618 _____ () C:\Users\Bolle\Documents\Playlist_23.aimppl
2014-10-20 13:51 - 2014-10-20 13:52 - 00344064 _____ () C:\Users\Bolle\Documents\Database2.accdb
2014-10-16 07:43 - 2014-10-16 07:43 - 00203559 _____ () C:\cranim_50.lsp
2014-10-16 07:42 - 2014-10-16 07:42 - 00143456 _____ () C:\cm_rec_50.lsp
2014-10-15 05:08 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 05:08 - 2014-09-29 01:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 05:08 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 05:08 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 05:08 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 05:08 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 05:08 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 05:08 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 05:08 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 05:08 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 05:08 - 2014-09-19 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 05:08 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 05:08 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 05:08 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 05:08 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 05:08 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 05:08 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 05:08 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 05:08 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 05:08 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 05:08 - 2014-09-19 01:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 05:08 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 05:08 - 2014-09-19 01:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 05:08 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 05:08 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 05:08 - 2014-09-19 01:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 05:08 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 05:08 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 05:08 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 05:08 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 05:08 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 05:08 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 05:08 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 05:08 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 05:08 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-15 05:08 - 2014-07-17 02:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 05:08 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 05:08 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 05:08 - 2014-07-17 02:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 05:08 - 2014-07-17 02:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 05:08 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 05:08 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 05:08 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-09 12:47 - 2014-10-09 12:51 - 01122304 _____ () C:\Users\Bolle\Documents\Database1.accdb
2014-10-09 12:05 - 2014-10-09 12:05 - 00000000 _____ () C:\Users\Bolle\Documents\ini.txt
2014-10-09 09:59 - 2014-10-09 09:59 - 01357360 _____ (Microsoft Corporation) C:\Users\Bolle\Downloads\Jet35sp3.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-05 14:58 - 2014-02-07 20:06 - 00000000 ____D () C:\FRST
2014-11-05 14:54 - 2013-12-05 11:38 - 00000000 ____D () C:\mcpqt63o.default
2014-11-05 14:52 - 2013-12-05 11:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-05 14:48 - 2014-08-19 16:15 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\AIMP3
2014-11-05 14:07 - 2013-12-05 11:08 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-11-05 13:45 - 2013-12-09 17:50 - 00000000 ____D () C:\Buero
2014-11-05 13:03 - 2014-01-27 15:50 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\MySQL
2014-11-05 06:54 - 2009-07-14 05:02 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-05 06:54 - 2009-07-14 05:02 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-05 06:52 - 2013-12-05 00:22 - 01805396 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-05 06:50 - 2013-12-05 00:19 - 01109335 _____ () C:\Windows\WindowsUpdate.log
2014-11-05 06:48 - 2013-12-12 17:30 - 00000000 ____D () C:\Users\Bolle\AppData\Local\FreePDF_XP
2014-11-05 06:48 - 2013-12-09 15:16 - 00000000 ___RD () C:\Users\Bolle\Dropbox
2014-11-05 06:48 - 2013-12-09 10:50 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Dropbox
2014-11-05 06:48 - 2013-12-05 00:28 - 00024944 _____ () C:\Windows\system32\Drivers\GVTDrv.sys
2014-11-05 06:48 - 2013-12-05 00:28 - 00017488 _____ (Windows (R) 2000 DDK provider) C:\Windows\gdrv.sys
2014-11-05 06:47 - 2013-12-05 00:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-11-05 06:47 - 2009-07-14 05:17 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-05 06:47 - 2009-07-14 05:07 - 00047978 _____ () C:\Windows\setupact.log
2014-11-04 19:36 - 2013-12-05 10:59 - 00000000 ____D () C:\Quellkotze
2014-11-04 10:39 - 2013-12-05 01:37 - 00269784 _____ () C:\Windows\PFRO.log
2014-11-04 10:28 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Vss
2014-11-03 17:36 - 2013-12-05 01:41 - 00000000 ____D () C:\Users\Bolle\Documents\Visual Studio 2010
2014-11-02 19:16 - 2009-07-14 03:37 - 00000000 __RHD () C:\Users\Default
2014-11-02 19:16 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Public
2014-11-02 19:15 - 2009-07-14 03:04 - 00000215 _____ () C:\Windows\system.ini
2014-10-31 18:34 - 2013-12-19 05:55 - 00000181 _____ () C:\Users\Bolle\AppData\Roaming\WB.CFG
2014-10-31 15:56 - 2013-12-05 01:42 - 00000000 ____D () C:\Users\Bolle\Documents\Visual Studio 2008
2014-10-31 14:00 - 2009-07-14 05:51 - 00000000 ____D () C:\Windows\twain_32
2014-10-29 17:29 - 2014-01-27 15:57 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\FileZilla
2014-10-29 15:55 - 2014-01-27 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-10-29 15:55 - 2014-01-27 15:57 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-10-29 06:45 - 2014-09-19 05:44 - 396964435 _____ () C:\Windows\MEMORY.DMP
2014-10-29 06:45 - 2014-09-19 05:44 - 00000000 ____D () C:\Windows\Minidump
2014-10-28 05:35 - 2013-12-05 00:52 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-27 15:15 - 2013-12-05 12:47 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\craniMAX
2014-10-27 15:10 - 2013-12-05 12:49 - 00376832 _____ (MARX CryptoTech LP ) C:\Windows\system32\MPIWIN32.DLL
2014-10-27 15:01 - 2013-12-05 12:49 - 00000000 ____D () C:\Program Files\CRANIMAX
2014-10-27 12:24 - 2013-12-05 15:25 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Ulead Systems
2014-10-27 12:24 - 2013-12-05 10:35 - 00000000 ____D () C:\ProgramData\Ulead Systems
2014-10-27 10:29 - 2009-07-14 05:51 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-10-24 16:10 - 2013-12-05 12:49 - 00000000 ____D () C:\Users\Bolle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CRANIMAX
2014-10-23 09:18 - 2014-08-29 10:41 - 00000000 ____D () C:\Users\Bolle\AppData\Local\Adobe
2014-10-23 09:18 - 2013-12-05 11:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-23 09:18 - 2013-12-05 11:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-20 04:47 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-10-20 04:43 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-20 04:07 - 2009-07-14 05:02 - 00663416 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-20 04:06 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-17 17:08 - 2014-06-27 11:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 17:05 - 2014-06-27 11:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-09 12:01 - 2013-12-18 14:31 - 00000000 ____D () C:\ProgramData\Roxio
2014-10-09 06:36 - 2013-12-05 02:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-10-09 06:36 - 2013-12-05 00:18 - 00000000 ____D () C:\Users\Bolle
2014-10-09 06:36 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp
2014-10-09 06:36 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2014-10-09 06:14 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-10-08 13:51 - 2014-06-10 13:27 - 00288156 _____ () C:\Users\Bolle\AppData\Local\debuggee.mdmp

Some content of TEMP:
====================
C:\Users\Bolle\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpdxuutb.dll
C:\Users\Bolle\AppData\Local\Temp\Quarantine.exe
C:\Users\Bolle\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-05 07:56

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Ob ich noch Probleme habe, kann ich noch nicht sagen, weil es mir nur beim Mailversenden aufgefallen ist und eben nicht immer passierte, aber ich werde ein Auge darauf haben.

Vorerst noch mal Danke!

Gruß
Bolle

Sieht gut aus

Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Danke für die Hilfe und für die Tipps!

Als Antivirensoftware benutze ich Kaspersky als Vollversion und aktualisiere immer.
Wir sitzen hier alle hinter einer professionellen Firewall und zu chip werde ich definitiv auch nicht mehr gehen - das ist schon eine Weile her.
Meine Vermutung ist immer noch die Datensicherung von damals.

Gruß
Bolle

Gern Geschehen