Virus lässt Antivir nicht laufen

hello234 · 15.11.2014, 15:52

Hey Leute,
habe vorkurzem mir "proxytube" runtergeladen und seitdem mehrere Viren auf meinen Laptop bekommen. Ich versuche mit Antivir alles durchzuscannen,jedoch tritt immer das selbe Problem auf. Manchmal schafft Antivir 30-50% durchzuscannen,findet bis dahin auch mehrere Viren und Warnungen,jedoch schaff ich nie zuende zu scannen. Jedesmal steht dann das ein Problem aufgetreten ist und das System neustarten muss.Mein Betriebssystem ist Windows 8.

Ich hoffe wirklich dass mir jemand weiterhelfen kann und wäre sehr dankbar!!
Liebe Grüße

schrauber · 15.11.2014, 15:59

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

hello234 · 15.11.2014, 18:11

hey schrauber danke für deine schnelle antwort

FRST.

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2014
Ran by Igor (administrator) on IGOR on 15-11-2014 17:52:30
Running from C:\Users\Igor\Desktop
Loaded Profile: Igor (Available profiles: Igor)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files\ASUS\P4G\InsOnSrv.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Users\Igor\AppData\Roaming\VOPackage\VOsrv.exe
(Word Proser) C:\Program Files (x86)\WordProser_1.10.0.2\Service\wpsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files\ASUS\P4G\InsOnWMI.exe
(ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(Microsoft Corporation) C:\Windows\System32\wsqmcons.exe
(Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(www.CloudGuard.me) C:\Program Files (x86)\CloudGuard\CloudGuard.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
() C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSPanel.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17200_none_fa7026dd9b04586e\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officec2rclient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\backgroundTaskHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s  RtHDVCpl    C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s  kernel32.dll 
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353432 2013-09-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3216032 2013-12-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\ASUSWSLoader.exe [63296 2013-08-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT&q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: WordProser -> {3EBB5099-9732-48AE-B032-58B702D86EEC} -> C:\Program Files\WordProser_1.10.0.2\IE\WordProserClientIE.dll (Word Proser)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} ->  No File
BHO-x32: WordProser -> {3EBB5099-9732-48AE-B032-58B702D86EEC} -> C:\Program Files (x86)\WordProser_1.10.0.2\IE\WordProserClientIE.dll (Word Proser)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{6C816D28-F254-4F85-A13B-11E0904908EF}: [NameServer] 31.168.224.100,5.135.12.56
Tcpip\..\Interfaces\{E819C368-A1D6-43DA-9DA9-47C9757399CD}: [NameServer] 31.168.224.100,5.135.12.56

FireFox:
========
FF ProfilePath: C:\Users\Igor\AppData\Roaming\Mozilla\Firefox\Profiles\3flls8qo.default
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Extension: Avira Browser Safety - C:\Users\Igor\AppData\Roaming\Mozilla\Firefox\Profiles\3flls8qo.default\Extensions\abs@avira.com [2014-11-13]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://google.de/"
CHR DefaultSearchKeyword: Default -> omiga-plus
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-07]
CHR Extension: (Google Drive) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-12]
CHR Extension: (YouTube) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-07]
CHR Extension: (Google-Suche) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-07]
CHR Extension: (Google Tabellen) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-07]
CHR Extension: (Avira Browser Safety) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-13]
CHR Extension: (Google Wallet) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-12]
CHR Extension: (Google Mail) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files\ASUS\P4G\InsOnSrv.exe [277120 2013-08-29] (ASUS)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe [71680 2013-08-16] (ASUS Cloud Corporation) [File not signed]
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227936 2013-11-09] (WildTangent)
R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2013-12-13] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2013-08-22] (Microsoft Corporation)
R2 servervo; C:\Users\Igor\AppData\Roaming\VOPackage\VOsrv.exe [89088 2014-11-12] () [File not signed]
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [490640 2014-11-12] (Fuyu LIMITED)
R2 wpsvc_1.10.0.2; C:\Program Files (x86)\WordProser_1.10.0.2\Service\wpsvc.exe [277584 2014-11-04] (Word Proser)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3880448 2013-11-13] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [138240 2013-06-22] (Advanced Micro Devices)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [70928 2013-12-12] (ASUS Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
R2 webinstrNew; C:\Windows\system32\Drivers\webinstrNew.sys [58040 2014-11-12] (Corsica)
R1 wpnfd_1_10_0_2; C:\Windows\System32\drivers\wpnfd_1_10_0_2.sys [58240 2014-11-04] (Word Proser)
U0 msahci; system32\drivers\msahci.sys

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-15 17:46 - 2014-11-15 17:52 - 00026853 _____ () C:\Users\Igor\Desktop\Addition.txt
2014-11-15 17:40 - 2014-11-15 17:52 - 00015966 _____ () C:\Users\Igor\Desktop\FRST.txt
2014-11-15 17:39 - 2014-11-15 17:52 - 00000000 ____D () C:\FRST
2014-11-15 17:36 - 2014-11-15 17:36 - 02116608 _____ (Farbar) C:\Users\Igor\Desktop\FRST64.exe
2014-11-15 15:37 - 2014-11-15 15:38 - 00280656 _____ () C:\Windows\Minidump\111514-61296-01.dmp
2014-11-14 15:36 - 2014-11-14 15:37 - 00280656 _____ () C:\Windows\Minidump\111414-73687-01.dmp
2014-11-14 13:19 - 2014-11-14 13:19 - 00001155 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-11-14 13:18 - 2014-11-15 17:06 - 00000000 ___RD () C:\Users\Igor\SkyDrive
2014-11-13 18:08 - 2014-11-13 18:08 - 00001134 _____ () C:\Users\Igor\Desktop\Continue Live Installation.lnk
2014-11-13 17:35 - 2014-11-15 15:37 - 290203536 _____ () C:\Windows\MEMORY.DMP
2014-11-13 17:35 - 2014-11-15 15:37 - 00000000 ____D () C:\Windows\Minidump
2014-11-13 17:35 - 2014-11-13 17:36 - 00280712 _____ () C:\Windows\Minidump\111314-51437-01.dmp
2014-11-13 15:45 - 2014-11-13 15:45 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Mozilla
2014-11-12 17:27 - 2014-11-12 17:27 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Avira
2014-11-12 17:25 - 2014-11-14 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-12 17:25 - 2014-11-12 17:25 - 00002088 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-11-12 17:23 - 2014-11-14 13:19 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-12 17:23 - 2014-11-13 15:42 - 00000000 ____D () C:\ProgramData\Avira
2014-11-12 17:23 - 2014-10-23 14:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-11-12 17:23 - 2014-10-23 14:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-11-12 17:23 - 2014-10-23 14:01 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-11-12 17:06 - 2014-11-12 17:18 - 151804352 _____ () C:\Users\Igor\Downloads\avira_free_antivirus_de_14.0.7.342.exe
2014-11-12 16:52 - 2014-11-12 16:55 - 00002273 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-12 16:52 - 2014-11-12 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-12 16:48 - 2014-11-15 17:53 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-12 16:48 - 2014-11-15 17:05 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-12 16:48 - 2014-11-12 16:48 - 00004088 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-12 16:48 - 2014-11-12 16:48 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-12 16:25 - 2014-11-12 16:25 - 00000000 ____D () C:\ProgramData\374311380
2014-11-12 16:18 - 2014-11-12 16:37 - 00000003 _____ () C:\Users\Igor\AppData\Local\proxy.log
2014-11-12 16:16 - 2014-11-13 19:30 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-11-12 16:16 - 2014-11-12 16:38 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-11-12 16:15 - 2014-11-13 17:35 - 00000000 ____D () C:\Program Files (x86)\Bench
2014-11-12 16:15 - 2014-11-12 16:15 - 00004016 _____ () C:\Windows\System32\Tasks\LaunchSignup
2014-11-12 16:15 - 2014-11-12 16:15 - 00000000 ____D () C:\Users\Igor\Documents\Optimizer Pro
2014-11-12 16:15 - 2014-11-12 16:15 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-11-12 16:14 - 2014-11-13 17:46 - 00000000 ____D () C:\Program Files (x86)\mbot_de_270
2014-11-12 16:14 - 2014-11-12 17:03 - 00000000 ____D () C:\Users\Igor\AppData\Local\mbot_de_270
2014-11-12 16:14 - 2014-11-12 16:15 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\VOPackage
2014-11-12 16:14 - 2014-11-12 16:14 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-11-12 16:14 - 2014-11-12 16:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY
2014-11-12 16:14 - 2014-11-12 16:14 - 00000000 ____D () C:\Program Files\WordProser_1.10.0.2
2014-11-12 16:13 - 2014-11-12 16:14 - 00000000 ____D () C:\Program Files (x86)\WordProser_1.10.0.2
2014-11-12 16:13 - 2014-11-12 16:13 - 00058040 _____ (Corsica) C:\Windows\system32\Drivers\webinstrNew.sys
2014-11-12 16:13 - 2014-11-12 16:13 - 00005258 _____ () C:\Windows\System32\Tasks\CloudScout
2014-11-12 16:13 - 2014-11-12 16:13 - 00002485 _____ () C:\Windows\patsearch.bin
2014-11-12 16:13 - 2014-11-12 16:13 - 00000414 _____ () C:\Windows\Tasks\NewPlayer Update.job
2014-11-12 16:13 - 2014-11-12 16:13 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrNew_01009.Wdf
2014-11-12 16:13 - 2014-11-12 16:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
2014-11-12 16:13 - 2014-11-12 16:13 - 00000000 ____D () C:\Program Files (x86)\ver1NewPlayer
2014-11-12 16:12 - 2014-11-12 16:40 - 00000000 ____D () C:\Program Files (x86)\CloudGuard
2014-11-12 01:43 - 2014-09-29 23:45 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-12 01:43 - 2014-09-29 23:45 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-11 19:00 - 2014-11-12 01:45 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-11-11 18:16 - 2013-10-31 01:29 - 00236888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-11-11 18:16 - 2013-10-31 01:28 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-11-09 16:55 - 2013-10-31 01:29 - 00124760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-11-09 16:30 - 2014-11-09 16:30 - 00000000 ____D () C:\Users\Igor\Documents\OneNote-Notizbücher
2014-11-09 15:16 - 2014-05-08 08:14 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-09 15:16 - 2014-05-08 06:52 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-09 15:16 - 2013-12-20 11:18 - 01643584 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-11-09 15:16 - 2013-12-20 11:18 - 01507704 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-11-09 15:16 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2014-11-09 15:16 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-11-09 15:15 - 2014-05-08 05:57 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-09 15:15 - 2014-05-08 05:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-09 15:14 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-09 15:14 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-09 15:14 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-09 15:14 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-09 15:14 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-09 15:14 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-09 15:14 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-09 15:14 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-09 15:14 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-09 15:14 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-09 15:14 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-09 15:14 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-09 15:14 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-09 15:14 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-09 15:14 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-09 15:14 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-09 15:14 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-09 15:14 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-09 15:14 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-09 15:14 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-09 15:14 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-09 15:14 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-09 15:14 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-09 15:14 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-09 15:14 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-09 15:14 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-09 15:14 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-09 15:14 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-09 15:14 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-09 15:14 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-09 15:14 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-09 15:14 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-09 15:14 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-09 15:14 - 2013-12-09 01:27 - 02152448 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-09 15:14 - 2013-12-09 00:54 - 01317376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-09 15:14 - 2013-10-19 09:53 - 00075360 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-11-09 15:14 - 2013-10-19 08:14 - 00070680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-11-09 15:09 - 2014-03-06 10:19 - 01287576 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-11-09 15:09 - 2014-03-06 10:02 - 01109424 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-11-09 15:09 - 2014-03-06 07:17 - 00835584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-11-09 15:09 - 2014-03-06 07:10 - 01036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-11-09 15:09 - 2014-01-29 09:47 - 02543960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-09 15:09 - 2014-01-07 06:00 - 02397184 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-09 15:09 - 2014-01-07 05:30 - 02071552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-11-09 15:09 - 2013-12-21 15:51 - 06353960 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-11-09 15:09 - 2013-11-21 07:42 - 04604416 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-11-09 15:09 - 2013-11-21 06:44 - 03936256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-11-09 15:08 - 2014-03-10 11:35 - 02008408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-11-09 15:08 - 2014-03-10 11:35 - 00377176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2014-11-09 15:08 - 2014-01-31 17:15 - 00311640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-11-09 15:08 - 2014-01-31 17:07 - 00233920 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-11-09 15:08 - 2014-01-31 17:06 - 02133208 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2014-11-09 15:08 - 2014-01-31 14:47 - 02143960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2014-11-09 15:08 - 2014-01-31 10:06 - 00716288 _____ (Microsoft Corporation) C:\Windows\system32\swprv.dll
2014-11-09 15:08 - 2014-01-29 09:53 - 00458616 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-11-09 15:08 - 2014-01-29 09:53 - 00407024 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-11-09 15:08 - 2014-01-29 09:49 - 01928144 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2014-11-09 15:08 - 2014-01-29 08:44 - 01371824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2014-11-09 15:08 - 2014-01-29 08:44 - 00408480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2014-11-09 15:08 - 2014-01-29 08:44 - 00369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2014-11-09 15:08 - 2014-01-29 07:41 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2014-11-09 15:08 - 2014-01-29 01:36 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-11-09 15:08 - 2014-01-27 20:07 - 04175360 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-11-09 15:08 - 2014-01-27 20:06 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-11-09 15:08 - 2014-01-27 20:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\DWWIN.EXE
2014-11-09 15:08 - 2014-01-27 19:23 - 02873344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2014-11-09 15:08 - 2014-01-27 19:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-11-09 15:08 - 2014-01-27 19:20 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
2014-11-09 15:08 - 2014-01-27 19:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-11-09 15:08 - 2014-01-27 18:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-11-09 15:08 - 2014-01-27 18:18 - 01486848 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2014-11-09 15:08 - 2014-01-27 18:00 - 01238016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2014-11-09 15:08 - 2014-01-27 16:58 - 05770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-11-09 15:08 - 2014-01-27 16:50 - 06640640 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-09 15:08 - 2014-01-27 12:45 - 00386722 _____ () C:\Windows\system32\ApnDatabase.xml
2014-11-09 15:08 - 2014-01-18 00:04 - 00764864 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2014-11-09 15:08 - 2014-01-17 22:54 - 00669352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2014-11-09 15:08 - 2013-12-21 09:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\sppcomapi.dll
2014-11-09 15:07 - 2013-11-27 16:36 - 03395920 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2014-11-09 15:07 - 2013-11-27 12:41 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\WSCollect.exe
2014-11-09 15:07 - 2013-11-27 11:34 - 00138240 _____ () C:\Windows\system32\OEMLicense.dll
2014-11-09 15:07 - 2013-11-27 10:54 - 00103936 _____ () C:\Windows\SysWOW64\OEMLicense.dll
2014-11-09 15:07 - 2013-11-27 09:48 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-11-09 15:07 - 2013-11-27 09:45 - 00206336 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll
2014-11-09 15:07 - 2013-11-27 09:40 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-11-09 15:07 - 2013-11-27 09:38 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll
2014-11-09 15:07 - 2013-11-27 09:17 - 00695808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-11-09 15:07 - 2013-11-27 09:12 - 00848384 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-11-09 15:06 - 2014-04-19 12:15 - 21186352 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-09 15:06 - 2014-04-19 07:49 - 18644072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-11-09 15:06 - 2014-02-11 04:04 - 04189184 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-09 15:06 - 2014-02-11 03:43 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-11-09 15:06 - 2014-02-11 03:04 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-11-09 15:06 - 2013-12-09 03:57 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-09 15:06 - 2013-12-09 02:51 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-09 15:06 - 2013-10-15 09:54 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-11-09 15:06 - 2013-10-15 09:03 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-11-09 15:05 - 2014-02-22 13:16 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2014-11-09 15:05 - 2014-02-22 12:24 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2014-11-09 14:42 - 2014-11-09 14:52 - 00000000 ____D () C:\Users\Igor\Desktop\2.Semester
2014-11-08 16:14 - 2014-11-08 16:14 - 00000000 ____D () C:\Users\Igor\Documents\Jobs
2014-11-08 15:11 - 2014-11-08 15:11 - 00000000 ____D () C:\Users\Igor\Documents\1.Semester
2014-11-08 15:09 - 2014-11-08 15:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-11-07 15:24 - 2014-10-30 12:25 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-07 15:02 - 2014-11-12 16:51 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-07 15:02 - 2014-11-07 15:09 - 00000000 ____D () C:\Users\Igor\AppData\Local\Google
2014-11-07 15:01 - 2014-11-12 16:48 - 00000000 ____D () C:\Users\Igor\AppData\Local\Deployment
2014-11-07 15:01 - 2014-11-07 15:01 - 00000000 ____D () C:\Users\Igor\AppData\Local\Apps\2.0
2014-11-07 14:58 - 2014-11-14 14:39 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{36A017E9-F9B6-4FC6-90C3-60C665D325DE}
2014-11-07 14:58 - 2014-11-07 14:58 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Macromedia
2014-11-07 14:56 - 2014-11-07 14:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-11-07 14:54 - 2014-11-07 14:54 - 00002227 _____ () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00002138 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00002138 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-11-07 14:54 - 2014-11-07 14:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-11-07 14:46 - 2014-11-09 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-11-07 14:46 - 2014-11-07 14:48 - 00002513 _____ () C:\Users\Igor\Desktop\Word 2013.lnk
2014-11-07 14:46 - 2014-11-07 14:48 - 00002427 _____ () C:\Users\Igor\Desktop\OneNote 2013.lnk
2014-11-07 14:45 - 2014-11-15 15:04 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-11-07 14:43 - 2014-11-15 17:11 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1327790859-2158625790-4212429010-1001
2014-11-07 14:42 - 2014-11-07 14:42 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\WebStorage
2014-11-07 14:40 - 2014-11-14 13:26 - 00000074 _____ () C:\Users\Igor\AppData\Roaming\sp_data.sys
2014-11-07 14:40 - 2014-11-14 13:18 - 00000000 ___RD () C:\Users\Igor\SkyDrive.old
2014-11-07 14:40 - 2014-11-07 14:40 - 00000000 ____D () C:\ProgramData\USBChargerPlus
2014-11-07 14:38 - 2014-11-07 14:38 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-11-07 14:37 - 2014-11-12 16:55 - 00001456 _____ () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-07 14:37 - 2014-11-12 01:45 - 00000000 ____D () C:\Users\Igor\AppData\Local\Packages
2014-11-07 14:37 - 2014-11-07 14:38 - 00000000 ____D () C:\Users\Igor\AppData\Local\ASUS
2014-11-07 14:37 - 2014-11-07 14:37 - 00000196 _____ () C:\Windows\FixPatch.log
2014-11-07 14:37 - 2014-11-07 14:37 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Adobe
2014-11-07 14:37 - 2014-11-07 14:37 - 00000000 ____D () C:\Users\Igor\AppData\Local\VirtualStore
2014-11-07 14:36 - 2014-11-15 17:05 - 00000000 ____D () C:\Users\Igor
2014-11-07 14:36 - 2014-11-07 14:36 - 00000020 ___SH () C:\Users\Igor\ntuser.ini
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Vorlagen
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Startmenü
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Netzwerkumgebung
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Lokale Einstellungen
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Eigene Dateien
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Druckumgebung
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Documents\Eigene Musik
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Documents\Eigene Bilder
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Local\Verlauf
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Local\Anwendungsdaten
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Anwendungsdaten
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-11-04 19:55 - 2014-11-04 19:55 - 00058240 _____ (Word Proser) C:\Windows\system32\Drivers\wpnfd_1_10_0_2.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-15 17:33 - 2014-03-08 00:18 - 01503239 _____ () C:\Windows\WindowsUpdate.log
2014-11-15 17:18 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-15 17:05 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2014-11-15 17:05 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-11-15 15:39 - 2014-03-08 00:21 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-11-15 15:37 - 2013-12-13 04:57 - 00159960 _____ () C:\Windows\PFRO.log
2014-11-15 15:37 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-14 13:20 - 2014-03-08 00:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-14 13:11 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-11-13 22:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-11-12 16:16 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-11-12 16:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-11-12 16:13 - 2013-08-22 15:46 - 00015342 _____ () C:\Windows\setupact.log
2014-11-12 01:51 - 2013-12-13 12:27 - 00797412 _____ () C:\Windows\system32\perfh013.dat
2014-11-12 01:51 - 2013-12-13 12:27 - 00161992 _____ () C:\Windows\system32\perfc013.dat
2014-11-12 01:51 - 2013-12-13 12:20 - 00793160 _____ () C:\Windows\system32\perfh010.dat
2014-11-12 01:51 - 2013-12-13 12:20 - 00156082 _____ () C:\Windows\system32\perfc010.dat
2014-11-12 01:51 - 2013-12-13 12:11 - 00801394 _____ () C:\Windows\system32\perfh00C.dat
2014-11-12 01:51 - 2013-12-13 12:11 - 00158846 _____ () C:\Windows\system32\perfc00C.dat
2014-11-12 01:51 - 2013-12-13 12:04 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2014-11-12 01:51 - 2013-12-13 12:04 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2014-11-12 01:51 - 2013-12-13 05:09 - 04646338 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-12 01:42 - 2013-08-22 15:44 - 00371160 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-11-11 18:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\restore
2014-11-09 16:40 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-11-07 14:38 - 2013-12-13 12:45 - 00000000 ____D () C:\Windows\Panther
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera
2014-11-07 14:37 - 2013-12-13 11:36 - 00000000 ____D () C:\Windows\Log
2014-11-07 14:33 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS


Some content of TEMP:
====================
C:\Users\Igor\AppData\Local\Temp\35C82FA7-6B80-E879-32FF-B9DF8D48C2EC.exe
C:\Users\Igor\AppData\Local\Temp\avgnt.exe
C:\Users\Igor\AppData\Local\Temp\BackupSetup.exe
C:\Users\Igor\AppData\Local\Temp\C577CECC-F937-ACDB-99A7-6834D7E84635.dll
C:\Users\Igor\AppData\Local\Temp\C577CECC-F937-ACDB-99A7-6834D7E84635.exe
C:\Users\Igor\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Igor\AppData\Local\Temp\optprosetup.exe
C:\Users\Igor\AppData\Local\Temp\SetupHomeStudentRetail.x86.de-DE_HomeStudentRetail_Y82F9-3YND9-24JKY-JQ89D-4F963_act_1_.exe
C:\Users\Igor\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-12-13 04:57

==================== End Of Log ============================

--- --- ---

Addition.

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-11-2014
Ran by Igor at 2014-11-15 17:59:26
Running from C:\Users\Igor\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AMD Catalyst Install Manager (HKLM\...\{1A954702-D98B-546F-C191-5137B4E25684}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.2.7 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 3.0.6 - ASUS)
ASUS Screen Saver (HKLM-x32\...\{0FBEEDF8-30FA-4FA3-B31F-C9C7E7E8DFA2}) (Version: 1.0.2 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.2.8 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0021 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 3.1.7 - ASUS)
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.12.311 - ASUSTEK)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0031 - ASUS)
Avira (HKLM-x32\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
CloudScout Parental Control (HKLM-x32\...\CloudGuard) (Version: 1.10 - CloudGuard.me)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.122 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Microsoft Office Home and Student 2013 - de-de (HKLM\...\HomeStudentRetail - de-de) (Version: 15.0.4667.1002 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1327790859-2158625790-4212429010-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
MyBestOffersToday 014.270 (HKLM-x32\...\mbot_de_270_is1) (Version:  - MYBESTOFFERSTODAY) <==== ATTENTION
NewPlayer (HKLM-x32\...\4EEEFDB0-F9D2-F665-6405-8C03A5299C6A) (Version:  - NewPlayer-software) <==== ATTENTION
OEM Application Profile (HKLM-x32\...\{70D5F822-F4C4-33D9-7EEC-2A4AF4EA7BDC}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7054 - Realtek Semiconductor Corp.)
Remote Desktop Access (VuuPC) (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.0.3.226 - ASUS Cloud Corporation)
WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-asus) (Version: 4.0.10.25 - WildTangent)
Windows Driver Package - ASUS (ATP) Mouse  (11/20/2013 1.0.0.194) (HKLM\...\8BA9C239ED04E09F06755E1497239BEFC08085C2) (Version: 11/20/2013 1.0.0.194 - ASUS)
WindowsMangerProtect20.0.0.1270 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.1270 - WindowsProtect LIMITED) <==== ATTENTION
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS)
Word Proser 1.10.0.2 (HKLM-x32\...\WordProser_1.10.0.2) (Version: 1.10.0.2 - Word Proser) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1327790859-2158625790-4212429010-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Igor\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1327790859-2158625790-4212429010-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Igor\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1327790859-2158625790-4212429010-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Igor\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1327790859-2158625790-4212429010-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Igor\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

13-11-2014 21:10:43 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2014-11-12 16:38 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0680FF4F-CC2D-4715-A288-DE8F9BAF1E9C} - System32\Tasks\ASUS Live Update2 => C:\Program Files (x86) [2014-11-13] ()
Task: {256E41DD-0191-4640-AB7B-D388EE0431C3} - System32\Tasks\ASUS InstantOn Config => C:\Program Files\ASUS\P4G\InsOnCfg.exe
Task: {2B105E45-8519-4771-B7BD-A899B21169CD} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86) [2014-11-13] ()
Task: {3B706236-E9C2-493D-9777-FC1F70EBD4B5} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-12-12] (AsusTek)
Task: {4F93C99A-1428-4E7E-8D23-F2E95A26F863} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2013-08-29] (ASUS)
Task: {55E25FA9-710D-41FC-B4D0-D2B72D7DAD1F} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2013-10-07] (ASUS)
Task: {6A77FBDC-85C5-4FCF-8987-B1725F0B763A} - System32\Tasks\ASUS Patch for Touch Panel => C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe [2013-01-09] (ASUSTek Computer INC.)
Task: {6C70FE64-4A2F-4263-8869-6CF10D77CDB8} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {7998314C-77F8-43D9-8FEE-204EE4844AD3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-12] (Google Inc.)
Task: {7FC079E4-2E35-4315-8F1F-507D7453768F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-10-07] (Microsoft Corporation)
Task: {AE18808D-B500-4134-A51C-A438DE036C7E} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe [2013-11-04] ()
Task: {BB15B8EB-4107-4777-81D0-96CFEE15FC6A} - System32\Tasks\ASUS Splendid ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-10-07] (ASUSTeK Computer Inc.)
Task: {BBD606EE-C2C9-4A19-9117-202EF2A79D3E} - System32\Tasks\P4GIntlCtrl => C:\Program Files\ASUS\P4G\IntlDPST.exe [2013-08-29] ()
Task: {D186FAC2-4B63-4712-978E-A5D9FF58B9EC} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2013-08-29] (ASUSTek Computer Inc.)
Task: {DC78AFA8-B74E-46BC-A56F-008B32E89C0B} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2013-11-27] ()
Task: {EE3D761B-4EEF-465C-BA4A-D7875051DEC5} - System32\Tasks\CloudScout => C:\Program Files (x86)\CloudGuard\CloudGuard.exe [2014-10-26] (www.CloudGuard.me)
Task: {F60B0A79-CC6F-4299-93E8-CF74A8279524} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-12] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\NewPlayer Update.job => C:\Program Files (x86)\ver1NewPlayer\T3NewPlayerX28.exe

==================== Loaded Modules (whitelisted) =============

2014-11-08 15:39 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-11-12 16:15 - 2014-11-12 16:15 - 00089088 _____ () C:\Users\Igor\AppData\Roaming\VOPackage\VOsrv.exe
2013-08-29 17:01 - 2013-08-29 17:01 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2014-03-08 00:44 - 2013-11-04 16:19 - 01957040 _____ () C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe
2012-03-08 03:27 - 2012-03-08 03:27 - 00016384 _____ () C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\ACVsWin.dll
2013-11-27 22:20 - 2013-11-27 22:20 - 00011776 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe
2014-11-07 15:26 - 2014-11-07 15:27 - 00027648 _____ () C:\Program Files\WindowsApps\Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt\Facebook.BackgroundTasks.winmd
2013-08-22 08:19 - 2013-08-22 07:54 - 00134144 _____ () C:\Windows\system32\WinMetadata\Windows.ApplicationModel.winmd
2014-11-07 15:26 - 2014-11-07 15:27 - 00123392 _____ () C:\Program Files\WindowsApps\Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt\Facebook-Win8-Base.DLL
2014-11-07 15:26 - 2014-11-07 15:27 - 00099840 _____ () C:\Program Files\WindowsApps\Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt\Facebook-Base.DLL
2014-11-07 15:26 - 2014-11-07 15:27 - 01884672 _____ () C:\Program Files\WindowsApps\Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt\Facebook-Services.DLL
2014-11-07 15:26 - 2014-11-07 15:27 - 00264192 _____ () C:\Program Files\WindowsApps\Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt\Facebook-Models.DLL
2013-08-22 08:19 - 2013-08-22 07:54 - 00096256 _____ () C:\Windows\system32\WinMetadata\Windows.Storage.winmd
2013-08-22 08:19 - 2013-08-22 07:54 - 00030208 _____ () C:\Windows\system32\WinMetadata\Windows.Foundation.winmd
2013-09-09 19:23 - 2013-09-09 19:23 - 00162816 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll
2013-10-08 21:41 - 2013-10-08 21:41 - 00037968 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll
2014-11-15 14:43 - 2014-11-15 14:43 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2014-11-12 16:52 - 2014-11-06 00:56 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.122\libglesv2.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Igor\SkyDrive:ms-properties
AlternateDataStreams: C:\Users\Igor\SkyDrive.old:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1327790859-2158625790-4212429010-500 - Administrator - Disabled)
Gast (S-1-5-21-1327790859-2158625790-4212429010-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1327790859-2158625790-4212429010-1003 - Limited - Enabled)
Igor (S-1-5-21-1327790859-2158625790-4212429010-1001 - Administrator - Enabled) => C:\Users\Igor

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/15/2014 05:23:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20279 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1328

Startzeit: 01d000efb7a7f71d

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe\LiveComm.exe

Berichts-ID: ade0dd60-6ce3-11e4-8260-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1

Error: (11/15/2014 05:23:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 47c

Startzeit: 01d000efb7bfce89

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: ade0b650-6ce3-11e4-8260-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (11/15/2014 05:23:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1048

Startzeit: 01d000efb7e5f80f

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: ade10470-6ce3-11e4-8260-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingNews_3.0.1.205_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexNews

Error: (11/15/2014 05:11:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1c0

Startzeit: 01d000ee17322932

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: 0dc8f860-6ce2-11e4-8260-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (11/15/2014 05:11:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20279 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: fec

Startzeit: 01d000ee17322932

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe\LiveComm.exe

Berichts-ID: 0dcb5ab8-6ce2-11e4-8260-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1

Error: (11/15/2014 03:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 850

Startzeit: 01d000dfcdefed88

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: bb7af323-6cd3-11e4-825f-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (11/15/2014 03:16:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 136c

Startzeit: 01d000ddfa8ae818

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: ede66b7c-6cd1-11e4-825f-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingNews_3.0.1.205_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AppexNews

Error: (11/15/2014 03:16:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: eec

Startzeit: 01d000ddfa8d4a7a

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: ede6446c-6cd1-11e4-825f-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: Microsoft.BingWeather_3.0.1.203_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (11/15/2014 03:14:00 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 31c

Startzeit: 01d000ddade18373

Endzeit: 4294967295

Anwendungspfad: C:\Windows\system32\backgroundTaskHost.exe

Berichts-ID: a19fbdc5-6cd1-11e4-825f-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (11/15/2014 03:13:57 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm LiveComm.exe, Version 17.5.9600.20279 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 654

Startzeit: 01d000ddaded6f53

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe\LiveComm.exe

Berichts-ID: a1916fb6-6cd1-11e4-825f-40167e4735b1

Vollständiger Name des fehlerhaften Pakets: microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ppleae38af2e007f4358a809ac99a64a67c1


System errors:
=============
Error: (11/15/2014 05:47:43 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (11/15/2014 05:47:13 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (11/15/2014 05:46:43 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (11/15/2014 05:46:13 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (11/15/2014 05:08:37 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Software Protection" wurde nicht richtig gestartet.

Error: (11/15/2014 03:38:15 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000000a (0xfffff8026a3d3854, 0x0000000000000002, 0x0000000000000008, 0xfffff8026a3d3854)C:\Windows\MEMORY.DMP111514-61296-01

Error: (11/15/2014 03:37:46 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎15.‎11.‎2014 um 15:10:57 unerwartet heruntergefahren.

Error: (11/14/2014 03:48:14 PM) (Source: DCOM) (EventID: 10010) (User: IGOR)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (11/14/2014 03:44:19 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" ist vom Dienst "Windows Search" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1070

Error: (11/14/2014 03:44:19 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Search" wurde nicht richtig gestartet.


Microsoft Office Sessions:
=========================
Error: (11/15/2014 05:23:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20279132801d000efb7a7f71d4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe\LiveComm.exeade0dd60-6ce3-11e4-8260-40167e4735b1microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (11/15/2014 05:23:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.1638447c01d000efb7bfce894294967295C:\Windows\system32\backgroundTaskHost.exeade0b650-6ce3-11e4-8260-40167e4735b1Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (11/15/2014 05:23:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.16384104801d000efb7e5f80f4294967295C:\Windows\system32\backgroundTaskHost.exeade10470-6ce3-11e4-8260-40167e4735b1Microsoft.BingNews_3.0.1.205_x64__8wekyb3d8bbweAppexNews

Error: (11/15/2014 05:11:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.163841c001d000ee173229324294967295C:\Windows\system32\backgroundTaskHost.exe0dc8f860-6ce2-11e4-8260-40167e4735b1Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (11/15/2014 05:11:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.20279fec01d000ee173229324294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe\LiveComm.exe0dcb5ab8-6ce2-11e4-8260-40167e4735b1microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (11/15/2014 03:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.1638485001d000dfcdefed884294967295C:\Windows\system32\backgroundTaskHost.exebb7af323-6cd3-11e4-825f-40167e4735b1Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (11/15/2014 03:16:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.16384136c01d000ddfa8ae8184294967295C:\Windows\system32\backgroundTaskHost.exeede66b7c-6cd1-11e4-825f-40167e4735b1Microsoft.BingNews_3.0.1.205_x64__8wekyb3d8bbweAppexNews

Error: (11/15/2014 03:16:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.16384eec01d000ddfa8d4a7a4294967295C:\Windows\system32\backgroundTaskHost.exeede6446c-6cd1-11e4-825f-40167e4735b1Microsoft.BingWeather_3.0.1.203_x64__8wekyb3d8bbweApp

Error: (11/15/2014 03:14:00 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.1638431c01d000ddade183734294967295C:\Windows\system32\backgroundTaskHost.exea19fbdc5-6cd1-11e4-825f-40167e4735b1Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (11/15/2014 03:13:57 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: LiveComm.exe17.5.9600.2027965401d000ddaded6f534294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbwe\LiveComm.exea1916fb6-6cd1-11e4-825f-40167e4735b1microsoft.windowscommunicationsapps_17.5.9600.20279_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1


==================== Memory info =========================== 

Processor: AMD A4-1200 APU with Radeon(TM) HD Graphics 
Percentage of memory in use: 90%
Total physical RAM: 1476.45 MB
Available physical RAM: 143.15 MB
Total Pagefile: 3332.45 MB
Available Pagefile: 737.8 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:119.24 GB) (Free:87.87 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:157.74 GB) (Free:157.63 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: FAE7D78D)

Partition: GPT Partition Type.

==================== End Of Log ============================

schrauber · 16.11.2014, 08:06

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

MyBestOffersToday 014.270

NewPlayer

Remote Desktop Access

WindowsMangerProtect20.0.0.1270 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.1270 - WindowsProtect LIMITED) <==== ATTENTION

Word Proser 1.10.0.2
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

hello234 · 16.11.2014, 18:09

Danke für die Anleitungen und die Hilfe!

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Update, 16.11.2014 15:18:54, SYSTEM, IGOR, Manual, Rootkit Database, 2014.9.18.1, 2014.11.12.1, 
Error, 16.11.2014 15:19:26, SYSTEM, IGOR, Manual, 0, 
Error, 16.11.2014 15:19:27, SYSTEM, IGOR, Manual, 0, 

(end)

Code:

ATTFilter

# AdwCleaner v4.101 - Bericht erstellt am 16/11/2014 um 17:45:09
# Aktualisiert 09/11/2014 von Xplode
# Database : 2014-11-16.1 [Live]
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Igor - IGOR
# Gestartet von : C:\Users\Igor\Desktop\AdwCleaner_4.101.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : webinstrNew

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
Ordner Gelöscht : C:\Program Files (x86)\Bench
Ordner Gelöscht : C:\Program Files (x86)\predm
Ordner Gelöscht : C:\Program Files (x86)\CloudGuard
Ordner Gelöscht : C:\Users\Igor\AppData\Local\Temp\CloudGuard
Ordner Gelöscht : C:\Users\Igor\Documents\Optimizer Pro
Datei Gelöscht : C:\Windows\System32\drivers\webinstrNew.sys
Datei Gelöscht : C:\Users\Igor\Desktop\Continue Live Installation.lnk

***** [ Tasks ] *****

Task Gelöscht : LaunchSignup

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3EBB5099-9732-48AE-B032-58B702D86EEC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3EBB5099-9732-48AE-B032-58B702D86EEC}
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\AdvertisingSupport
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKLM\SOFTWARE\CloudGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudGuard

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16518


-\\ Mozilla Firefox v


-\\ Google Chrome v38.0.2125.122

[C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT&q={searchTerms}
[C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT&q={searchTerms}
[C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT&q={searchTerms}
[C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1415805259&from=tugs&uid=TOSHIBAXMQ01ABF032_Z3K9C54ITXXZ3K9C54IT&q={searchTerms}

*************************

AdwCleaner[R0].txt - [3521 octets] - [16/11/2014 17:41:24]
AdwCleaner[S0].txt - [3283 octets] - [16/11/2014 17:45:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3343 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Windows 8.1 x64
Ran by Igor on 16.11.2014 at 17:51:42,69
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.11.2014 at 17:59:32,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-11-2014 02
Ran by Igor (administrator) on IGOR on 16-11-2014 18:02:08
Running from C:\Users\Igor\Desktop
Loaded Profile: Igor (Available profiles: Igor)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files\ASUS\P4G\InsOnSrv.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files\ASUS\P4G\InsOnWMI.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSPanel.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17200_none_fa7026dd9b04586e\TiWorker.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s  RtHDVCpl    C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s  kernel32.dll 
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353432 2013-09-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3216032 2013-12-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\ASUSWSLoader.exe [63296 2013-08-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1327790859-2158625790-4212429010-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{6C816D28-F254-4F85-A13B-11E0904908EF}: [NameServer] 31.168.224.100,5.135.12.56
Tcpip\..\Interfaces\{E819C368-A1D6-43DA-9DA9-47C9757399CD}: [NameServer] 31.168.224.100,5.135.12.56

FireFox:
========
FF ProfilePath: C:\Users\Igor\AppData\Roaming\Mozilla\Firefox\Profiles\3flls8qo.default
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Extension: Avira Browser Safety - C:\Users\Igor\AppData\Roaming\Mozilla\Firefox\Profiles\3flls8qo.default\Extensions\abs@avira.com [2014-11-13]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://google.de/"
CHR DefaultSearchKeyword: Default -> omiga-plus
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-07]
CHR Extension: (Google Drive) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-12]
CHR Extension: (YouTube) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-07]
CHR Extension: (Google-Suche) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-07]
CHR Extension: (Google Tabellen) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-07]
CHR Extension: (Avira Browser Safety) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-13]
CHR Extension: (Google Wallet) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-12]
CHR Extension: (Google Mail) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files\ASUS\P4G\InsOnSrv.exe [277120 2013-08-29] (ASUS)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe [71680 2013-08-16] (ASUS Cloud Corporation) [File not signed]
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227936 2013-11-09] (WildTangent)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3880448 2013-11-13] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [138240 2013-06-22] (Advanced Micro Devices)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [70928 2013-12-12] (ASUS Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-16] (Malwarebytes Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys
S1 wpnfd_1_10_0_2; system32\drivers\wpnfd_1_10_0_2.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-16 18:02 - 2014-11-16 18:03 - 00013775 _____ () C:\Users\Igor\Desktop\FRST.txt
2014-11-16 18:01 - 2014-11-16 18:01 - 00000000 ____D () C:\Users\Igor\Desktop\FRST-OlderVersion
2014-11-16 17:59 - 2014-11-16 17:59 - 00000613 _____ () C:\Users\Igor\Desktop\JRT.txt
2014-11-16 17:51 - 2014-11-16 17:51 - 00000000 ____D () C:\Windows\ERUNT
2014-11-16 17:50 - 2014-11-16 17:50 - 00003423 _____ () C:\Users\Igor\Desktop\AdwCleaner[S0].txt
2014-11-16 17:41 - 2014-11-16 17:45 - 00000000 ____D () C:\AdwCleaner
2014-11-16 17:40 - 2014-11-16 17:40 - 00000268 _____ () C:\Users\Igor\Desktop\mbam.txt
2014-11-16 16:59 - 2014-11-16 17:00 - 01707532 _____ (Thisisu) C:\Users\Igor\Desktop\JRT.exe
2014-11-16 16:57 - 2014-11-16 16:57 - 02140160 _____ () C:\Users\Igor\Desktop\AdwCleaner_4.101.exe
2014-11-16 15:18 - 2014-11-16 16:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-16 15:18 - 2014-11-16 15:18 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-16 15:18 - 2014-11-16 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-16 15:17 - 2014-11-16 15:17 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-16 15:17 - 2014-11-16 15:17 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-11-16 15:17 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-16 15:17 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-16 15:17 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-16 14:39 - 2014-11-16 14:39 - 00001286 _____ () C:\Users\Igor\Desktop\Revo Uninstaller.lnk
2014-11-16 14:39 - 2014-11-16 14:39 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-11-16 14:38 - 2014-11-16 14:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Igor\Downloads\revosetup95 (1).exe
2014-11-15 17:39 - 2014-11-16 18:02 - 00000000 ____D () C:\FRST
2014-11-15 17:36 - 2014-11-16 18:01 - 02117120 _____ (Farbar) C:\Users\Igor\Desktop\FRST64.exe
2014-11-15 15:37 - 2014-11-15 15:38 - 00280656 _____ () C:\Windows\Minidump\111514-61296-01.dmp
2014-11-14 15:36 - 2014-11-14 15:37 - 00280656 _____ () C:\Windows\Minidump\111414-73687-01.dmp
2014-11-14 13:19 - 2014-11-14 13:19 - 00001155 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-11-14 13:18 - 2014-11-16 17:55 - 00000000 ___RD () C:\Users\Igor\SkyDrive
2014-11-13 17:35 - 2014-11-15 15:37 - 290203536 _____ () C:\Windows\MEMORY.DMP
2014-11-13 17:35 - 2014-11-15 15:37 - 00000000 ____D () C:\Windows\Minidump
2014-11-13 17:35 - 2014-11-13 17:36 - 00280712 _____ () C:\Windows\Minidump\111314-51437-01.dmp
2014-11-13 15:45 - 2014-11-13 15:45 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Mozilla
2014-11-12 17:27 - 2014-11-12 17:27 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Avira
2014-11-12 17:25 - 2014-11-14 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-12 17:25 - 2014-11-12 17:25 - 00002088 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-11-12 17:23 - 2014-11-14 13:19 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-12 17:23 - 2014-11-13 15:42 - 00000000 ____D () C:\ProgramData\Avira
2014-11-12 17:23 - 2014-10-23 14:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-11-12 17:23 - 2014-10-23 14:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-11-12 17:23 - 2014-10-23 14:01 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-11-12 17:06 - 2014-11-12 17:18 - 151804352 _____ () C:\Users\Igor\Downloads\avira_free_antivirus_de_14.0.7.342.exe
2014-11-12 16:52 - 2014-11-12 16:55 - 00002273 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-12 16:52 - 2014-11-12 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-12 16:48 - 2014-11-16 17:53 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-12 16:48 - 2014-11-16 17:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-12 16:48 - 2014-11-12 16:48 - 00004088 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-12 16:48 - 2014-11-12 16:48 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-12 16:16 - 2014-11-12 16:38 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-11-12 16:13 - 2014-11-12 16:13 - 00005258 _____ () C:\Windows\System32\Tasks\CloudScout
2014-11-12 16:13 - 2014-11-12 16:13 - 00002485 _____ () C:\Windows\patsearch.bin
2014-11-12 16:13 - 2014-11-12 16:13 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrNew_01009.Wdf
2014-11-12 01:43 - 2014-09-29 23:45 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-12 01:43 - 2014-09-29 23:45 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-11 19:00 - 2014-11-12 01:45 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-11-11 18:16 - 2013-10-31 01:29 - 00236888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-11-11 18:16 - 2013-10-31 01:28 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-11-09 16:55 - 2013-10-31 01:29 - 00124760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-11-09 16:30 - 2014-11-09 16:30 - 00000000 ____D () C:\Users\Igor\Documents\OneNote-Notizbücher
2014-11-09 15:16 - 2014-05-08 08:14 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-09 15:16 - 2014-05-08 06:52 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-09 15:16 - 2013-12-20 11:18 - 01643584 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-11-09 15:16 - 2013-12-20 11:18 - 01507704 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-11-09 15:16 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2014-11-09 15:16 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-11-09 15:15 - 2014-05-08 05:57 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-09 15:15 - 2014-05-08 05:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-09 15:14 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-09 15:14 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-09 15:14 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-09 15:14 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-09 15:14 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-09 15:14 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-09 15:14 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-09 15:14 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-09 15:14 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-09 15:14 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-09 15:14 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-09 15:14 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-09 15:14 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-09 15:14 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-09 15:14 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-09 15:14 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-09 15:14 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-09 15:14 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-09 15:14 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-09 15:14 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-09 15:14 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-09 15:14 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-09 15:14 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-09 15:14 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-09 15:14 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-09 15:14 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-09 15:14 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-09 15:14 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-09 15:14 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-09 15:14 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-09 15:14 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-09 15:14 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-09 15:14 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-09 15:14 - 2013-12-09 01:27 - 02152448 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-09 15:14 - 2013-12-09 00:54 - 01317376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-09 15:14 - 2013-10-19 09:53 - 00075360 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-11-09 15:14 - 2013-10-19 08:14 - 00070680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-11-09 15:09 - 2014-03-06 10:19 - 01287576 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-11-09 15:09 - 2014-03-06 10:02 - 01109424 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-11-09 15:09 - 2014-03-06 07:17 - 00835584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-11-09 15:09 - 2014-03-06 07:10 - 01036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-11-09 15:09 - 2014-01-29 09:47 - 02543960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-09 15:09 - 2014-01-07 06:00 - 02397184 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-09 15:09 - 2014-01-07 05:30 - 02071552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-11-09 15:09 - 2013-12-21 15:51 - 06353960 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-11-09 15:09 - 2013-11-21 07:42 - 04604416 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-11-09 15:09 - 2013-11-21 06:44 - 03936256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-11-09 15:08 - 2014-03-10 11:35 - 02008408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-11-09 15:08 - 2014-03-10 11:35 - 00377176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2014-11-09 15:08 - 2014-01-31 17:15 - 00311640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-11-09 15:08 - 2014-01-31 17:07 - 00233920 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-11-09 15:08 - 2014-01-31 17:06 - 02133208 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2014-11-09 15:08 - 2014-01-31 14:47 - 02143960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2014-11-09 15:08 - 2014-01-31 10:06 - 00716288 _____ (Microsoft Corporation) C:\Windows\system32\swprv.dll
2014-11-09 15:08 - 2014-01-29 09:53 - 00458616 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-11-09 15:08 - 2014-01-29 09:53 - 00407024 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-11-09 15:08 - 2014-01-29 09:49 - 01928144 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2014-11-09 15:08 - 2014-01-29 08:44 - 01371824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2014-11-09 15:08 - 2014-01-29 08:44 - 00408480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2014-11-09 15:08 - 2014-01-29 08:44 - 00369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2014-11-09 15:08 - 2014-01-29 07:41 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2014-11-09 15:08 - 2014-01-29 01:36 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-11-09 15:08 - 2014-01-27 20:07 - 04175360 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-11-09 15:08 - 2014-01-27 20:06 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-11-09 15:08 - 2014-01-27 20:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\DWWIN.EXE
2014-11-09 15:08 - 2014-01-27 19:23 - 02873344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2014-11-09 15:08 - 2014-01-27 19:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-11-09 15:08 - 2014-01-27 19:20 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
2014-11-09 15:08 - 2014-01-27 19:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-11-09 15:08 - 2014-01-27 18:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-11-09 15:08 - 2014-01-27 18:18 - 01486848 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2014-11-09 15:08 - 2014-01-27 18:00 - 01238016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2014-11-09 15:08 - 2014-01-27 16:58 - 05770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-11-09 15:08 - 2014-01-27 16:50 - 06640640 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-09 15:08 - 2014-01-27 12:45 - 00386722 _____ () C:\Windows\system32\ApnDatabase.xml
2014-11-09 15:08 - 2014-01-18 00:04 - 00764864 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2014-11-09 15:08 - 2014-01-17 22:54 - 00669352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2014-11-09 15:08 - 2013-12-21 09:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\sppcomapi.dll
2014-11-09 15:07 - 2013-11-27 16:36 - 03395920 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2014-11-09 15:07 - 2013-11-27 12:41 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\WSCollect.exe
2014-11-09 15:07 - 2013-11-27 11:34 - 00138240 _____ () C:\Windows\system32\OEMLicense.dll
2014-11-09 15:07 - 2013-11-27 10:54 - 00103936 _____ () C:\Windows\SysWOW64\OEMLicense.dll
2014-11-09 15:07 - 2013-11-27 09:48 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-11-09 15:07 - 2013-11-27 09:45 - 00206336 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll
2014-11-09 15:07 - 2013-11-27 09:40 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-11-09 15:07 - 2013-11-27 09:38 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll
2014-11-09 15:07 - 2013-11-27 09:17 - 00695808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-11-09 15:07 - 2013-11-27 09:12 - 00848384 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-11-09 15:06 - 2014-04-19 12:15 - 21186352 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-09 15:06 - 2014-04-19 07:49 - 18644072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-11-09 15:06 - 2014-02-11 04:04 - 04189184 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-09 15:06 - 2014-02-11 03:43 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-11-09 15:06 - 2014-02-11 03:04 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-11-09 15:06 - 2013-12-09 03:57 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-09 15:06 - 2013-12-09 02:51 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-09 15:06 - 2013-10-15 09:54 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-11-09 15:06 - 2013-10-15 09:03 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-11-09 15:05 - 2014-02-22 13:16 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2014-11-09 15:05 - 2014-02-22 12:24 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2014-11-09 14:42 - 2014-11-09 14:52 - 00000000 ____D () C:\Users\Igor\Desktop\2.Semester
2014-11-08 16:14 - 2014-11-08 16:14 - 00000000 ____D () C:\Users\Igor\Documents\Jobs
2014-11-08 15:11 - 2014-11-08 15:11 - 00000000 ____D () C:\Users\Igor\Documents\1.Semester
2014-11-08 15:09 - 2014-11-08 15:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-11-07 15:24 - 2014-10-30 12:25 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-07 15:02 - 2014-11-12 16:51 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-07 15:02 - 2014-11-07 15:09 - 00000000 ____D () C:\Users\Igor\AppData\Local\Google
2014-11-07 15:01 - 2014-11-12 16:48 - 00000000 ____D () C:\Users\Igor\AppData\Local\Deployment
2014-11-07 15:01 - 2014-11-07 15:01 - 00000000 ____D () C:\Users\Igor\AppData\Local\Apps\2.0
2014-11-07 14:58 - 2014-11-16 17:54 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{36A017E9-F9B6-4FC6-90C3-60C665D325DE}
2014-11-07 14:58 - 2014-11-07 14:58 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Macromedia
2014-11-07 14:56 - 2014-11-07 14:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-11-07 14:54 - 2014-11-07 14:54 - 00002227 _____ () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00002138 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00002138 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-11-07 14:54 - 2014-11-07 14:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-11-07 14:46 - 2014-11-09 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-11-07 14:46 - 2014-11-07 14:48 - 00002513 _____ () C:\Users\Igor\Desktop\Word 2013.lnk
2014-11-07 14:46 - 2014-11-07 14:48 - 00002427 _____ () C:\Users\Igor\Desktop\OneNote 2013.lnk
2014-11-07 14:45 - 2014-11-15 15:04 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-11-07 14:43 - 2014-11-16 18:00 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1327790859-2158625790-4212429010-1001
2014-11-07 14:42 - 2014-11-07 14:42 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\WebStorage
2014-11-07 14:40 - 2014-11-16 17:51 - 00000074 _____ () C:\Users\Igor\AppData\Roaming\sp_data.sys
2014-11-07 14:40 - 2014-11-14 13:18 - 00000000 ___RD () C:\Users\Igor\SkyDrive.old
2014-11-07 14:40 - 2014-11-07 14:40 - 00000000 ____D () C:\ProgramData\USBChargerPlus
2014-11-07 14:38 - 2014-11-07 14:38 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-11-07 14:37 - 2014-11-12 16:55 - 00001456 _____ () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-07 14:37 - 2014-11-12 01:45 - 00000000 ____D () C:\Users\Igor\AppData\Local\Packages
2014-11-07 14:37 - 2014-11-07 14:38 - 00000000 ____D () C:\Users\Igor\AppData\Local\ASUS
2014-11-07 14:37 - 2014-11-07 14:37 - 00000196 _____ () C:\Windows\FixPatch.log
2014-11-07 14:37 - 2014-11-07 14:37 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Adobe
2014-11-07 14:37 - 2014-11-07 14:37 - 00000000 ____D () C:\Users\Igor\AppData\Local\VirtualStore
2014-11-07 14:36 - 2014-11-15 18:13 - 00000000 ____D () C:\Users\Igor
2014-11-07 14:36 - 2014-11-07 14:36 - 00000020 ___SH () C:\Users\Igor\ntuser.ini
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Vorlagen
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Startmenü
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Netzwerkumgebung
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Lokale Einstellungen
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Eigene Dateien
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Druckumgebung
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Documents\Eigene Musik
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Documents\Eigene Bilder
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Local\Verlauf
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Local\Anwendungsdaten
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Anwendungsdaten
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-16 18:00 - 2014-03-08 00:18 - 01692893 _____ () C:\Windows\WindowsUpdate.log
2014-11-16 18:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2014-11-16 17:52 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-11-16 17:47 - 2013-12-13 04:57 - 00166996 _____ () C:\Windows\PFRO.log
2014-11-16 17:47 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-16 17:47 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-11-16 17:39 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-16 16:44 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Cursors
2014-11-15 18:14 - 2014-03-08 00:21 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-11-14 13:20 - 2014-03-08 00:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-11-13 22:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-11-12 16:16 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-11-12 16:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-11-12 16:13 - 2013-08-22 15:46 - 00015342 _____ () C:\Windows\setupact.log
2014-11-12 01:51 - 2013-12-13 12:27 - 00797412 _____ () C:\Windows\system32\perfh013.dat
2014-11-12 01:51 - 2013-12-13 12:27 - 00161992 _____ () C:\Windows\system32\perfc013.dat
2014-11-12 01:51 - 2013-12-13 12:20 - 00793160 _____ () C:\Windows\system32\perfh010.dat
2014-11-12 01:51 - 2013-12-13 12:20 - 00156082 _____ () C:\Windows\system32\perfc010.dat
2014-11-12 01:51 - 2013-12-13 12:11 - 00801394 _____ () C:\Windows\system32\perfh00C.dat
2014-11-12 01:51 - 2013-12-13 12:11 - 00158846 _____ () C:\Windows\system32\perfc00C.dat
2014-11-12 01:51 - 2013-12-13 12:04 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2014-11-12 01:51 - 2013-12-13 12:04 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2014-11-12 01:51 - 2013-12-13 05:09 - 04646338 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-12 01:42 - 2013-08-22 15:44 - 00371160 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-11-11 18:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\restore
2014-11-09 16:40 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-11-07 14:38 - 2013-12-13 12:45 - 00000000 ____D () C:\Windows\Panther
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera
2014-11-07 14:37 - 2013-12-13 11:36 - 00000000 ____D () C:\Windows\Log
2014-11-07 14:33 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS


Some content of TEMP:
====================
C:\Users\Igor\AppData\Local\Temp\35C82FA7-6B80-E879-32FF-B9DF8D48C2EC.exe
C:\Users\Igor\AppData\Local\Temp\avgnt.exe
C:\Users\Igor\AppData\Local\Temp\BackupSetup.exe
C:\Users\Igor\AppData\Local\Temp\C577CECC-F937-ACDB-99A7-6834D7E84635.dll
C:\Users\Igor\AppData\Local\Temp\C577CECC-F937-ACDB-99A7-6834D7E84635.exe
C:\Users\Igor\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Igor\AppData\Local\Temp\optprosetup.exe
C:\Users\Igor\AppData\Local\Temp\Quarantine.exe
C:\Users\Igor\AppData\Local\Temp\SetupHomeStudentRetail.x86.de-DE_HomeStudentRetail_Y82F9-3YND9-24JKY-JQ89D-4F963_act_1_.exe
C:\Users\Igor\AppData\Local\Temp\sqlite3.dll
C:\Users\Igor\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-12-13 04:57

==================== End Of Log ============================

--- --- ---

schrauber · 17.11.2014, 11:06

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

hello234 · 17.11.2014, 22:25

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=91e7d4e02a34b443b69e7ee43ca4999d
# engine=21128
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-11-17 04:59:45
# local_time=2014-11-17 05:59:45 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 26719 2174270 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 0 33559882 0 0
# scanned=261570
# found=14
# cleaned=0
# scan_time=9539
sh=6E5D0AB18B498E8EBC6BAB9C850F38D26CE427F9 ft=1 fh=8a80bf55b7b691e4 vn="Win64/Adware.AddLyrics.D Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\webinstrNew.sys.vir"
sh=51182D68700F6346F130D9515266ACEA11D37E31 ft=1 fh=f1d9b4c6247a89bd vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\ICReinstall_nsb1EA4.tmp"
sh=932B7F68DA71C18216B8704A9043706FADAEE43F ft=1 fh=cae7aa9c891955be vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\ICReinstall_nsc3806.tmp"
sh=E537C5E898151E1CA95242FC4039245BFFB63754 ft=1 fh=014e7059891955be vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\ICReinstall_nsjEDD8.tmp"
sh=51182D68700F6346F130D9515266ACEA11D37E31 ft=1 fh=f1d9b4c6247a89bd vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\nsb1EA4.tmp"
sh=932B7F68DA71C18216B8704A9043706FADAEE43F ft=1 fh=cae7aa9c891955be vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\nsc3806.tmp"
sh=E537C5E898151E1CA95242FC4039245BFFB63754 ft=1 fh=014e7059891955be vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\nsjEDD8.tmp"
sh=75417E5AB458F12115402E20859836A0695FF110 ft=1 fh=59cc105841bb2939 vn="Variante von Win32/OptimizerEliteMax.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\optprosetup.exe"
sh=FF167554E222581AB6AAC171BFA8D6A2D00E0707 ft=1 fh=2bebed7c5dbdf682 vn="Win32/VOPackage.AR evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\C6CBtmp\vopackage.exe"
sh=BD6824E580A7D281B36E65DBFEF126F0B47DEF70 ft=1 fh=7ba9456952af5c3e vn="Variante von Win32/AdWare.SpeedingUpMyPC.N Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\C6DCtmp\optimizerpro.exe"
sh=AF023CD20C85601E6874CB788BCAA49AE325A40D ft=1 fh=da3b4c00ec0bc47d vn="Win32/MyPCBackup.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\C6DDtmp\cloud_backup_setup.exe"
sh=80A21F5B1F5ED9FC86A9A1788B4B49663275C8F3 ft=1 fh=8f4f1153a9f61db7 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Igor\AppData\Local\Temp\C6DFtmp\browser guard.exe"
sh=09111513A79AC69C0BCBF1D08A1B3078C2E8869E ft=1 fh=8f6e8bf97097548d vn="Variante von MSIL/Adware.iBryte.H Anwendung" ac=I fn="C:\Users\Igor\AppData\Local\Temp\C6F1tmp\installer.exe"
sh=4A8E7BB4131FD859A703BB82DE653E353FF89248 ft=1 fh=b612f2277cb5a4d5 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Igor\AppData\Local\Temp\C702tmp\mybestofferstoday.exe"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.89  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop      
Windows Defender   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Google Chrome 38.0.2125.122  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-11-2014 02
Ran by Igor (administrator) on IGOR on 17-11-2014 22:07:10
Running from C:\Users\Igor\Desktop
Loaded Profile: Igor (Available profiles: Igor)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files\ASUS\P4G\InsOnSrv.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17200_none_fa7026dd9b04586e\TiWorker.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files\ASUS\P4G\InsOnWMI.exe
(ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
() C:\Users\Igor\Desktop\SecurityCheck.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSPanel.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officec2rclient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s  RtHDVCpl    C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s  kernel32.dll 
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353432 2013-09-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3216032 2013-12-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\ASUSWSLoader.exe [63296 2013-08-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1327790859-2158625790-4212429010-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASJB
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{6C816D28-F254-4F85-A13B-11E0904908EF}: [NameServer] 31.168.224.100,5.135.12.56
Tcpip\..\Interfaces\{E819C368-A1D6-43DA-9DA9-47C9757399CD}: [NameServer] 31.168.224.100,5.135.12.56

FireFox:
========
FF ProfilePath: C:\Users\Igor\AppData\Roaming\Mozilla\Firefox\Profiles\3flls8qo.default
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Extension: Avira Browser Safety - C:\Users\Igor\AppData\Roaming\Mozilla\Firefox\Profiles\3flls8qo.default\Extensions\abs@avira.com [2014-11-13]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://google.de/"
CHR DefaultSearchKeyword: Default -> omiga-plus
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-07]
CHR Extension: (Google Drive) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-12]
CHR Extension: (YouTube) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-07]
CHR Extension: (Google-Suche) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-07]
CHR Extension: (Google Tabellen) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-07]
CHR Extension: (Avira Browser Safety) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-13]
CHR Extension: (Google Wallet) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-12]
CHR Extension: (Google Mail) - C:\Users\Igor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files\ASUS\P4G\InsOnSrv.exe [277120 2013-08-29] (ASUS)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe [71680 2013-08-16] (ASUS Cloud Corporation) [File not signed]
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227936 2013-11-09] (WildTangent)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3880448 2013-11-13] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [138240 2013-06-22] (Advanced Micro Devices)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [70928 2013-12-12] (ASUS Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-16] (Malwarebytes Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys
S1 wpnfd_1_10_0_2; system32\drivers\wpnfd_1_10_0_2.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-17 22:07 - 2014-11-17 22:08 - 00013599 _____ () C:\Users\Igor\Desktop\FRST.txt
2014-11-17 22:02 - 2014-11-17 22:02 - 00000655 _____ () C:\Users\Igor\Desktop\checkup.txt
2014-11-17 18:17 - 2014-11-17 18:17 - 00854448 _____ () C:\Users\Igor\Desktop\SecurityCheck.exe
2014-11-17 18:03 - 2014-11-17 18:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-17 18:03 - 2014-10-31 23:26 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-17 11:37 - 2014-11-17 11:37 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-11-17 11:36 - 2014-11-17 11:36 - 02347384 _____ (ESET) C:\Users\Igor\Desktop\esetsmartinstaller_deu.exe
2014-11-16 18:01 - 2014-11-16 18:01 - 00000000 ____D () C:\Users\Igor\Desktop\FRST-OlderVersion
2014-11-16 17:59 - 2014-11-16 17:59 - 00000613 _____ () C:\Users\Igor\Desktop\JRT.txt
2014-11-16 17:51 - 2014-11-16 17:51 - 00000000 ____D () C:\Windows\ERUNT
2014-11-16 17:50 - 2014-11-16 17:50 - 00003423 _____ () C:\Users\Igor\Desktop\AdwCleaner[S0].txt
2014-11-16 17:41 - 2014-11-16 17:45 - 00000000 ____D () C:\AdwCleaner
2014-11-16 17:40 - 2014-11-16 17:40 - 00000268 _____ () C:\Users\Igor\Desktop\mbam.txt
2014-11-16 16:59 - 2014-11-16 17:00 - 01707532 _____ (Thisisu) C:\Users\Igor\Desktop\JRT.exe
2014-11-16 16:57 - 2014-11-16 16:57 - 02140160 _____ () C:\Users\Igor\Desktop\AdwCleaner_4.101.exe
2014-11-16 15:18 - 2014-11-16 16:50 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-16 15:18 - 2014-11-16 15:18 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-16 15:18 - 2014-11-16 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-16 15:17 - 2014-11-16 15:17 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-16 15:17 - 2014-11-16 15:17 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-11-16 15:17 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-16 15:17 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-16 15:17 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-16 14:39 - 2014-11-16 14:39 - 00001286 _____ () C:\Users\Igor\Desktop\Revo Uninstaller.lnk
2014-11-16 14:39 - 2014-11-16 14:39 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-11-16 14:38 - 2014-11-16 14:39 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Igor\Downloads\revosetup95 (1).exe
2014-11-15 17:39 - 2014-11-17 22:07 - 00000000 ____D () C:\FRST
2014-11-15 17:36 - 2014-11-16 18:01 - 02117120 _____ (Farbar) C:\Users\Igor\Desktop\FRST64.exe
2014-11-15 15:37 - 2014-11-15 15:38 - 00280656 _____ () C:\Windows\Minidump\111514-61296-01.dmp
2014-11-14 15:36 - 2014-11-14 15:37 - 00280656 _____ () C:\Windows\Minidump\111414-73687-01.dmp
2014-11-14 13:19 - 2014-11-14 13:19 - 00001155 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-11-14 13:18 - 2014-11-17 21:49 - 00000000 ___RD () C:\Users\Igor\SkyDrive
2014-11-13 17:35 - 2014-11-15 15:37 - 290203536 _____ () C:\Windows\MEMORY.DMP
2014-11-13 17:35 - 2014-11-15 15:37 - 00000000 ____D () C:\Windows\Minidump
2014-11-13 17:35 - 2014-11-13 17:36 - 00280712 _____ () C:\Windows\Minidump\111314-51437-01.dmp
2014-11-13 15:45 - 2014-11-13 15:45 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Mozilla
2014-11-12 17:27 - 2014-11-12 17:27 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Avira
2014-11-12 17:25 - 2014-11-14 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-12 17:25 - 2014-11-12 17:25 - 00002088 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-11-12 17:23 - 2014-11-14 13:19 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-12 17:23 - 2014-11-13 15:42 - 00000000 ____D () C:\ProgramData\Avira
2014-11-12 17:23 - 2014-10-23 14:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-11-12 17:23 - 2014-10-23 14:02 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-11-12 17:23 - 2014-10-23 14:01 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-11-12 17:06 - 2014-11-12 17:18 - 151804352 _____ () C:\Users\Igor\Downloads\avira_free_antivirus_de_14.0.7.342.exe
2014-11-12 16:52 - 2014-11-12 16:55 - 00002273 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-12 16:52 - 2014-11-12 16:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-12 16:48 - 2014-11-17 21:57 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-12 16:48 - 2014-11-17 21:57 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-12 16:48 - 2014-11-12 16:48 - 00004088 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-12 16:48 - 2014-11-12 16:48 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-12 16:16 - 2014-11-12 16:38 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-11-12 16:13 - 2014-11-12 16:13 - 00005258 _____ () C:\Windows\System32\Tasks\CloudScout
2014-11-12 16:13 - 2014-11-12 16:13 - 00002485 _____ () C:\Windows\patsearch.bin
2014-11-12 16:13 - 2014-11-12 16:13 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrNew_01009.Wdf
2014-11-12 01:43 - 2014-09-29 23:45 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-12 01:43 - 2014-09-29 23:45 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-11 19:00 - 2014-11-12 01:45 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-11-11 18:16 - 2013-10-31 01:29 - 00236888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-11-11 18:16 - 2013-10-31 01:28 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-11-09 16:55 - 2013-10-31 01:29 - 00124760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-11-09 16:30 - 2014-11-09 16:30 - 00000000 ____D () C:\Users\Igor\Documents\OneNote-Notizbücher
2014-11-09 15:16 - 2014-05-08 08:14 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-09 15:16 - 2014-05-08 06:52 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-09 15:16 - 2013-12-20 11:18 - 01643584 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-11-09 15:16 - 2013-12-20 11:18 - 01507704 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-11-09 15:16 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2014-11-09 15:16 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-11-09 15:15 - 2014-05-08 05:57 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-09 15:15 - 2014-05-08 05:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-09 15:14 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-09 15:14 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-09 15:14 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-09 15:14 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-09 15:14 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-09 15:14 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-09 15:14 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-09 15:14 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-09 15:14 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-09 15:14 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-09 15:14 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-09 15:14 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-09 15:14 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-09 15:14 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-09 15:14 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-09 15:14 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-09 15:14 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-09 15:14 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-09 15:14 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-09 15:14 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-09 15:14 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-09 15:14 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-09 15:14 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-09 15:14 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-09 15:14 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-09 15:14 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-09 15:14 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-09 15:14 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-09 15:14 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-09 15:14 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-09 15:14 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-09 15:14 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-09 15:14 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-09 15:14 - 2013-12-09 01:27 - 02152448 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-09 15:14 - 2013-12-09 00:54 - 01317376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-09 15:14 - 2013-10-19 09:53 - 00075360 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-11-09 15:14 - 2013-10-19 08:14 - 00070680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-11-09 15:09 - 2014-03-06 10:19 - 01287576 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-11-09 15:09 - 2014-03-06 10:02 - 01109424 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-11-09 15:09 - 2014-03-06 07:17 - 00835584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-11-09 15:09 - 2014-03-06 07:10 - 01036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-11-09 15:09 - 2014-01-29 09:47 - 02543960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-09 15:09 - 2014-01-07 06:00 - 02397184 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-11-09 15:09 - 2014-01-07 05:30 - 02071552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-11-09 15:09 - 2013-12-21 15:51 - 06353960 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-11-09 15:09 - 2013-11-21 07:42 - 04604416 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-11-09 15:09 - 2013-11-21 06:44 - 03936256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-11-09 15:08 - 2014-03-10 11:35 - 02008408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-11-09 15:08 - 2014-03-10 11:35 - 00377176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2014-11-09 15:08 - 2014-01-31 17:15 - 00311640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-11-09 15:08 - 2014-01-31 17:07 - 00233920 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-11-09 15:08 - 2014-01-31 17:06 - 02133208 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2014-11-09 15:08 - 2014-01-31 14:47 - 02143960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2014-11-09 15:08 - 2014-01-31 10:06 - 00716288 _____ (Microsoft Corporation) C:\Windows\system32\swprv.dll
2014-11-09 15:08 - 2014-01-29 09:53 - 00458616 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2014-11-09 15:08 - 2014-01-29 09:53 - 00407024 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-11-09 15:08 - 2014-01-29 09:49 - 01928144 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2014-11-09 15:08 - 2014-01-29 08:44 - 01371824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2014-11-09 15:08 - 2014-01-29 08:44 - 00408480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2014-11-09 15:08 - 2014-01-29 08:44 - 00369280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2014-11-09 15:08 - 2014-01-29 07:41 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2014-11-09 15:08 - 2014-01-29 01:36 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-11-09 15:08 - 2014-01-27 20:07 - 04175360 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-11-09 15:08 - 2014-01-27 20:06 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-11-09 15:08 - 2014-01-27 20:04 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\DWWIN.EXE
2014-11-09 15:08 - 2014-01-27 19:23 - 02873344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2014-11-09 15:08 - 2014-01-27 19:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-11-09 15:08 - 2014-01-27 19:20 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
2014-11-09 15:08 - 2014-01-27 19:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-11-09 15:08 - 2014-01-27 18:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-11-09 15:08 - 2014-01-27 18:18 - 01486848 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2014-11-09 15:08 - 2014-01-27 18:00 - 01238016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2014-11-09 15:08 - 2014-01-27 16:58 - 05770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-11-09 15:08 - 2014-01-27 16:50 - 06640640 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-11-09 15:08 - 2014-01-27 12:45 - 00386722 _____ () C:\Windows\system32\ApnDatabase.xml
2014-11-09 15:08 - 2014-01-18 00:04 - 00764864 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2014-11-09 15:08 - 2014-01-17 22:54 - 00669352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2014-11-09 15:08 - 2013-12-21 09:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\sppcomapi.dll
2014-11-09 15:07 - 2013-11-27 16:36 - 03395920 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2014-11-09 15:07 - 2013-11-27 12:41 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\WSCollect.exe
2014-11-09 15:07 - 2013-11-27 11:34 - 00138240 _____ () C:\Windows\system32\OEMLicense.dll
2014-11-09 15:07 - 2013-11-27 10:54 - 00103936 _____ () C:\Windows\SysWOW64\OEMLicense.dll
2014-11-09 15:07 - 2013-11-27 09:48 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-11-09 15:07 - 2013-11-27 09:45 - 00206336 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll
2014-11-09 15:07 - 2013-11-27 09:40 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-11-09 15:07 - 2013-11-27 09:38 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll
2014-11-09 15:07 - 2013-11-27 09:17 - 00695808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-11-09 15:07 - 2013-11-27 09:12 - 00848384 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-11-09 15:06 - 2014-04-19 12:15 - 21186352 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-09 15:06 - 2014-04-19 07:49 - 18644072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-11-09 15:06 - 2014-02-11 04:04 - 04189184 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-09 15:06 - 2014-02-11 03:43 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-11-09 15:06 - 2014-02-11 03:04 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-11-09 15:06 - 2013-12-09 03:57 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-09 15:06 - 2013-12-09 02:51 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-09 15:06 - 2013-10-15 09:54 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-11-09 15:06 - 2013-10-15 09:03 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-11-09 15:05 - 2014-02-22 13:16 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2014-11-09 15:05 - 2014-02-22 12:24 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2014-11-09 14:42 - 2014-11-09 14:52 - 00000000 ____D () C:\Users\Igor\Desktop\2.Semester
2014-11-08 16:14 - 2014-11-08 16:14 - 00000000 ____D () C:\Users\Igor\Documents\Jobs
2014-11-08 15:11 - 2014-11-08 15:11 - 00000000 ____D () C:\Users\Igor\Documents\1.Semester
2014-11-08 15:09 - 2014-11-08 15:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-11-07 15:24 - 2014-10-30 12:25 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-07 15:02 - 2014-11-12 16:51 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-07 15:02 - 2014-11-07 15:09 - 00000000 ____D () C:\Users\Igor\AppData\Local\Google
2014-11-07 15:01 - 2014-11-12 16:48 - 00000000 ____D () C:\Users\Igor\AppData\Local\Deployment
2014-11-07 15:01 - 2014-11-07 15:01 - 00000000 ____D () C:\Users\Igor\AppData\Local\Apps\2.0
2014-11-07 14:58 - 2014-11-17 18:41 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{36A017E9-F9B6-4FC6-90C3-60C665D325DE}
2014-11-07 14:58 - 2014-11-07 14:58 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Macromedia
2014-11-07 14:56 - 2014-11-07 14:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-11-07 14:54 - 2014-11-07 14:54 - 00002227 _____ () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00002138 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00002138 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk
2014-11-07 14:54 - 2014-11-07 14:54 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-11-07 14:54 - 2014-11-07 14:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft SkyDrive
2014-11-07 14:46 - 2014-11-09 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-11-07 14:46 - 2014-11-07 14:48 - 00002513 _____ () C:\Users\Igor\Desktop\Word 2013.lnk
2014-11-07 14:46 - 2014-11-07 14:48 - 00002427 _____ () C:\Users\Igor\Desktop\OneNote 2013.lnk
2014-11-07 14:45 - 2014-11-15 15:04 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-11-07 14:43 - 2014-11-17 21:53 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1327790859-2158625790-4212429010-1001
2014-11-07 14:42 - 2014-11-07 14:42 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\WebStorage
2014-11-07 14:40 - 2014-11-17 21:57 - 00000074 _____ () C:\Users\Igor\AppData\Roaming\sp_data.sys
2014-11-07 14:40 - 2014-11-14 13:18 - 00000000 ___RD () C:\Users\Igor\SkyDrive.old
2014-11-07 14:40 - 2014-11-07 14:40 - 00000000 ____D () C:\ProgramData\USBChargerPlus
2014-11-07 14:38 - 2014-11-07 14:38 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-11-07 14:37 - 2014-11-12 16:55 - 00001456 _____ () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-07 14:37 - 2014-11-12 01:45 - 00000000 ____D () C:\Users\Igor\AppData\Local\Packages
2014-11-07 14:37 - 2014-11-07 14:38 - 00000000 ____D () C:\Users\Igor\AppData\Local\ASUS
2014-11-07 14:37 - 2014-11-07 14:37 - 00000196 _____ () C:\Windows\FixPatch.log
2014-11-07 14:37 - 2014-11-07 14:37 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Adobe
2014-11-07 14:37 - 2014-11-07 14:37 - 00000000 ____D () C:\Users\Igor\AppData\Local\VirtualStore
2014-11-07 14:36 - 2014-11-15 18:13 - 00000000 ____D () C:\Users\Igor
2014-11-07 14:36 - 2014-11-07 14:36 - 00000020 ___SH () C:\Users\Igor\ntuser.ini
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Vorlagen
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Startmenü
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Netzwerkumgebung
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Lokale Einstellungen
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Eigene Dateien
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Druckumgebung
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Documents\Eigene Musik
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Documents\Eigene Bilder
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Local\Verlauf
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\AppData\Local\Anwendungsdaten
2014-11-07 14:36 - 2014-11-07 14:36 - 00000000 _SHDL () C:\Users\Igor\Anwendungsdaten
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-11-07 14:36 - 2013-08-22 16:36 - 00000000 ____D () C:\Users\Igor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-17 22:08 - 2014-03-08 00:18 - 01704839 _____ () C:\Windows\WindowsUpdate.log
2014-11-17 22:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2014-11-17 22:00 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-17 18:54 - 2014-03-08 00:21 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-11-17 18:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-11-16 17:47 - 2013-12-13 04:57 - 00166996 _____ () C:\Windows\PFRO.log
2014-11-16 17:47 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-16 17:47 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-11-16 16:44 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Cursors
2014-11-14 13:20 - 2014-03-08 00:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-11-14 13:07 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-11-13 22:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-11-12 16:16 - 2013-08-22 16:36 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-11-12 16:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-11-12 16:13 - 2013-08-22 15:46 - 00015342 _____ () C:\Windows\setupact.log
2014-11-12 01:51 - 2013-12-13 12:27 - 00797412 _____ () C:\Windows\system32\perfh013.dat
2014-11-12 01:51 - 2013-12-13 12:27 - 00161992 _____ () C:\Windows\system32\perfc013.dat
2014-11-12 01:51 - 2013-12-13 12:20 - 00793160 _____ () C:\Windows\system32\perfh010.dat
2014-11-12 01:51 - 2013-12-13 12:20 - 00156082 _____ () C:\Windows\system32\perfc010.dat
2014-11-12 01:51 - 2013-12-13 12:11 - 00801394 _____ () C:\Windows\system32\perfh00C.dat
2014-11-12 01:51 - 2013-12-13 12:11 - 00158846 _____ () C:\Windows\system32\perfc00C.dat
2014-11-12 01:51 - 2013-12-13 12:04 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2014-11-12 01:51 - 2013-12-13 12:04 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2014-11-12 01:51 - 2013-12-13 05:09 - 04646338 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-12 01:42 - 2013-08-22 15:44 - 00371160 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore
2014-11-11 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-11-11 18:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\restore
2014-11-09 16:40 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-11-07 14:38 - 2013-12-13 12:45 - 00000000 ____D () C:\Windows\Panther
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager
2014-11-07 14:38 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera
2014-11-07 14:37 - 2013-12-13 11:36 - 00000000 ____D () C:\Windows\Log
2014-11-07 14:33 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS


Some content of TEMP:
====================
C:\Users\Igor\AppData\Local\Temp\avgnt.exe
C:\Users\Igor\AppData\Local\Temp\BackupSetup.exe
C:\Users\Igor\AppData\Local\Temp\C577CECC-F937-ACDB-99A7-6834D7E84635.dll
C:\Users\Igor\AppData\Local\Temp\C577CECC-F937-ACDB-99A7-6834D7E84635.exe
C:\Users\Igor\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Igor\AppData\Local\Temp\optprosetup.exe
C:\Users\Igor\AppData\Local\Temp\Quarantine.exe
C:\Users\Igor\AppData\Local\Temp\SetupHomeStudentRetail.x86.de-DE_HomeStudentRetail_Y82F9-3YND9-24JKY-JQ89D-4F963_act_1_.exe
C:\Users\Igor\AppData\Local\Temp\sqlite3.dll
C:\Users\Igor\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-12-13 04:57

==================== End Of Log ============================

--- --- ---

schrauber · 18.11.2014, 12:46

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

hello234 · 18.11.2014, 15:56

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-11-2014 02
Ran by Igor at 2014-11-18 15:09:37 Run:1
Running from C:\Users\Igor\Desktop
Loaded Profile: Igor (Available profiles: Igor)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Emptytemp:
         
*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
EmptyTemp: => Removed 328.1 MB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

Den Schritt mit dem Defogger und Combofix hab ich jetzt nicht wirklich verstanden.Was genau ist das bzw wo finde ich was verwendet wurde?
Sollten die Viren jetzt alle gelöscht sein,oder sind sie nochvorhanden können aber nicht zugreifen?
nochmals vielen vielen dank,hast mir wirklich geholfen!!!hinterlasse gerne einen lob

schrauber · 19.11.2014, 14:55

Haben wir nicht benutzt, kannst gleich Delfix laufen lassen

Gern Geschehen

19.11.2014, 14:55	#10
schrauber /// the machine /// TB-Ausbilder	Virus lässt Antivir nicht laufen Haben wir nicht benutzt, kannst gleich Delfix laufen lassen Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Virus lässt Antivir nicht laufen

Plagegeister aller Art und deren Bekämpfung: Virus lässt Antivir nicht laufen