Windows7: Ads by clickup

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-11-2014 01
Ran by Myriam at 2014-11-24 15:37:34
Running from C:\Users\Myriam\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.4.154 - Adobe Systems, Inc.)
BoBrowser (HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\...\BoBrowser) (Version: 36.0.1985.131 - BoBrowser) <==== ATTENTION
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
clicup (HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\...\clicup) (Version: 1.0 - Ad Businness Crown Solutions)
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
EasyCash&Tax 2.15 (HKLM-x32\...\EasyCash&Tax_is1) (Version: - tm)
EasyRide&Tax 2.2 (HKLM-x32\...\EasyRide&Tax_is1) (Version: - tm)
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.3.1.0 - Genesys Logic)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3383 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.33 - Intel Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
PDF Creator (HKLM\...\PDF Creator) (Version: - )
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.806.806.022114 - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.80.218.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7188 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0237 - )
RocketTab (HKLM-x32\...\RocketTab) (Version: - RocketTab) <==== ATTENTION
SaleItCoupon (HKLM-x32\...\{37476589-E48E-439E-A706-56189E2ED4C4}_is1) (Version: - SaleItCoupon) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
SmootherWeb (HKU\S-1-5-21-1313315996-2717873473-2842918071-1000 Version: 1.0 - SmootherWeb LLC) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 7 (HKLM-x32\...\TeamViewer 7) (Version: 7.0.14563 - TeamViewer)
WindowsMangerProtect20.0.0.1270 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.1270 - WindowsProtect LIMITED) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

12-11-2014 19:54:17 Windows Update
13-11-2014 11:38:36 Removed DriverUpdate
13-11-2014 11:59:44 Removed SlimCleaner Plus
13-11-2014 12:00:02 Removed DriverUpdate
14-11-2014 18:00:03 Windows-Sicherung
17-11-2014 07:26:16 Windows Update
19-11-2014 21:28:36 Windows Update
21-11-2014 18:00:06 Windows-Sicherung
21-11-2014 19:27:12 Windows Update
23-11-2014 11:06:29 Removed Microsoft Silverlight

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {212D6219-4550-4D60-9AB7-BD4DB801AF4E} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {36A7554D-40F5-4CB5-BABB-A2E448252085} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {3DF8667D-2A89-4F3A-B1A9-9F4AB11351BE} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: {60C1F26F-1E5F-4360-8546-6B96E644373C} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: {93CE497B-B917-44BA-BD64-DE85F685579F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {AEB89269-D705-40B9-9C47-A6B8BBAF24CF} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\Search Extensions\uninstall.exe [2014-11-23] () <==== ATTENTION
Task: {C170EF29-2782-4E21-B0DA-6061E9D6F6E3} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files (x86)\Search Extensions\Client.exe" /Preferred=true <==== ATTENTION
Task: {DF19386C-AB80-4284-84EA-B3B8B5B67A56} - System32\Tasks\Digital Sites => C:\Users\Myriam\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe [2014-11-08] () <==== ATTENTION
Task: {E221BF50-FDC2-4FA2-8DFE-25F0760D9844} - System32\Tasks\Run_Bobby_Browser => C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe [2014-10-22] (The BoBrowser Authors)
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Myriam\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-11-08 11:29 - 2011-10-04 21:43 - 00087552 _____ () C:\Windows\System32\custmon64i.dll
2014-10-18 12:39 - 2014-01-06 17:47 - 00053248 _____ () C:\Windows\SysWOW64\UMonit64.exe
2014-11-23 09:46 - 2014-11-23 09:46 - 05812224 _____ () C:\Program Files (x86)\Search Extensions\Client.exe
2014-10-18 12:41 - 2014-01-22 13:04 - 00084992 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-11-23 10:01 - 2014-11-02 10:35 - 00268600 _____ () C:\Windows\SysWOW64\lsdprn.exe
2014-10-18 12:34 - 2013-10-01 16:09 - 00078880 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
2014-11-23 09:46 - 2014-10-22 10:35 - 00873472 _____ () C:\Users\Myriam\AppData\Local\BoBrowser\Application\36.0.1985.131\libglesv2.dll
2014-11-23 09:46 - 2014-10-22 10:35 - 00128512 _____ () C:\Users\Myriam\AppData\Local\BoBrowser\Application\36.0.1985.131\libegl.dll
2014-11-23 09:46 - 2014-10-22 10:35 - 00387072 _____ () C:\Users\Myriam\AppData\Local\BoBrowser\Application\36.0.1985.131\ppGoogleNaClPluginChrome.dll
2014-11-23 09:46 - 2014-10-22 10:35 - 02012160 _____ () C:\Users\Myriam\AppData\Local\BoBrowser\Application\36.0.1985.131\ffmpegsumo.dll
2014-10-18 12:35 - 2013-09-04 06:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-11-11 07:00 - 2014-11-11 07:00 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-10-20 07:32 - 2014-10-20 07:32 - 16832176 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Myriam\Downloads\X17-75062.exe:AFP_AfpInfo
AlternateDataStreams: C:\Users\Myriam\Downloads\X17-75062.exe:Mac_Metadata

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1313315996-2717873473-2842918071-500 - Administrator - Disabled)
Gast (S-1-5-21-1313315996-2717873473-2842918071-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1313315996-2717873473-2842918071-1002 - Limited - Enabled)
Myriam (S-1-5-21-1313315996-2717873473-2842918071-1000 - Administrator - Enabled) => C:\Users\Myriam

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/23/2014 00:16:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/23/2014 11:57:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/23/2014 10:01:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.0.5423, Zeitstempel: 0x545c0a59
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.0.5423, Zeitstempel: 0x545be5ee
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xaf8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (11/23/2014 09:47:48 AM) (Source: MsiInstaller) (EventID: 11309) (User: Myriam-PC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it.

Error: (11/23/2014 09:46:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.0.5423, Zeitstempel: 0x545c0a59
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.0.5423, Zeitstempel: 0x545be5ee
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x1188
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (11/23/2014 09:35:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.0.5423, Zeitstempel: 0x545c0a59
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.0.5423, Zeitstempel: 0x545be5ee
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x15e8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (11/22/2014 06:36:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/20/2014 06:39:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 10:23:44 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 10:14:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/23/2014 00:16:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "globalUpdate Update Service (globalUpdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/23/2014 00:14:51 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (11/23/2014 00:10:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Computer Backup (MyPC Backup)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/23/2014 11:58:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "globalUpdate Update Service (globalUpdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (11/23/2014 11:56:42 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (11/23/2014 11:56:00 AM) (Source: volmgr) (EventID: 49) (User: )
Description: Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist fehlgeschlagen. Stellen
Sie sicher, dass eine Auslagerungsdatei auf der Startpartition vorhanden ist und dass diese
groß genug ist, um den gesamten physikalischen Speicher abbilden zu können.

Error: (11/23/2014 09:46:38 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "ClaraUpdater" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/22/2014 00:09:04 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{905AFA44-4336-45E6-A9B1-D6C7A57ECB5E}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/21/2014 06:10:24 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{905AFA44-4336-45E6-A9B1-D6C7A57ECB5E}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/20/2014 11:22:51 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.


Microsoft Office Sessions:
=========================
Error: (11/23/2014 00:16:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/23/2014 11:57:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/23/2014 10:01:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.0.5423545c0a59mozalloc.dll33.1.0.5423545be5ee8000000300001425af801d006fbe309974bC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll58ce4ca8-72ef-11e4-ac05-9cad97aa1f76

Error: (11/23/2014 09:47:48 AM) (Source: MsiInstaller) (EventID: 11309) (User: Myriam-PC)
Description: Product: Google Update Helper -- Error 1309. Error reading from file: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\Google\Update\RequiredFile.txt. System error 3. Verify that the file exists and that you can access it.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (11/23/2014 09:46:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.0.5423545c0a59mozalloc.dll33.1.0.5423545be5ee8000000300001425118801d006f95de3d8b8C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll3643d75b-72ed-11e4-ac05-9cad97aa1f76

Error: (11/23/2014 09:35:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.0.5423545c0a59mozalloc.dll33.1.0.5423545be5ee800000030000142515e801d006f47871de29C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlla364e7eb-72eb-11e4-ac05-9cad97aa1f76

Error: (11/22/2014 06:36:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/20/2014 06:39:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 10:23:44 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 10:14:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-4010U CPU @ 1.70GHz
Percentage of memory in use: 54%
Total physical RAM: 4003.95 MB
Available physical RAM: 1839.23 MB
Total Pagefile: 8006.07 MB
Available Pagefile: 5497.65 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.54 GB) (Free:409.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: D9FA2484)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2014 01
Ran by Myriam (administrator) on MYRIAM-PC on 24-11-2014 15:37:09
Running from C:\Users\Myriam\Downloads
Loaded Profile: Myriam (Available profiles: Myriam)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Windows\SysWOW64\UMonit64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(clicup) C:\Users\Myriam\AppData\Local\clicup\chrmndr.exe
(The BoBrowser Authors) C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(The BoBrowser Authors) C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe
(The BoBrowser Authors) C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe
(The BoBrowser Authors) C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe
(The BoBrowser Authors) C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe
() C:\Program Files (x86)\Search Extensions\Client.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(ClaraLabs) C:\Program Files (x86)\Common Files\ClaraUpdater\ClaraUpdater.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Windows\SysWOW64\lsdprn.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\RtkBleServ.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_189.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-02-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-25] (Realtek Semiconductor)
HKLM\...\Run: [UMonit64] => C:\Windows\SysWOW64\UMonit64.exe [53248 2014-01-06] ()
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216064 2014-01-06] (Realtek Semiconductor Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-06-09] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [mbot_de_300] => [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\...\Run: [smoother] => C:\Users\Myriam\AppData\Roaming\SmootherWeb\SmootherWeb-Installer.exe [489651 2014-08-27] ()
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\...\Run: [clicup-Agent] => C:\Users\Myriam\AppData\Local\clicup\chrmndr.exe [509424 2014-11-06] (clicup)
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\...\Run: [BoBrowser] => C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe [7348224 2014-10-22] (The BoBrowser Authors)
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\system32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\...\MountPoints2: {995bf4fa-56b4-11e4-82bf-c58847a17502} - E:\LaunchU3.exe -a
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [S-1-5-21-1313315996-2717873473-2842918071-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-1313315996-2717873473-2842918071-1000] => http=127.0.0.1:49203;https=127.0.0.1:49203
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE160AC8BCAEACF01
HKU\S-1-5-21-1313315996-2717873473-2842918071-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1415877113&from=cor&uid=ST500LM000-SSHD-8GB_W760PNH6XXXXW760PNH6&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1415877113&from=cor&uid=ST500LM000-SSHD-8GB_W760PNH6XXXXW760PNH6&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1415877113&from=cor&uid=ST500LM000-SSHD-8GB_W760PNH6XXXXW760PNH6&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1415877113&from=cor&uid=ST500LM000-SSHD-8GB_W760PNH6XXXXW760PNH6&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_secureddownload_14_46_ff&cd=2XzuyEtN2Y1L1Qzuzy0C0A0DzyyB0A0AtC0FyByCyCzy0CyCtN0D0Tzu0StCtDyEyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0D0F0D0F0CtAtAtG0AtAyEzytG0ByB0EtDtGyD0DyB0AtGtC0DtBtBtCtDyB0A0FtA0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Bzy0Dzy0D0A0BtCtGyBzytC0EtGyEtDzytCtGzytCyB0EtG0F0ByBtD0F0DyCyCyEtB0A0F2Q&cr=1160581219&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_secureddownload_14_46_ff&cd=2XzuyEtN2Y1L1Qzuzy0C0A0DzyyB0A0AtC0FyByCyCzy0CyCtN0D0Tzu0StCtDyEyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0D0F0D0F0CtAtAtG0AtAyEzytG0ByB0EtDtGyD0DyB0AtGtC0DtBtBtCtDyB0A0FtA0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Bzy0Dzy0D0A0BtCtGyBzytC0EtGyEtDzytCtGzytCyB0EtG0F0ByBtD0F0DyCyCyEtB0A0F2Q&cr=1160581219&ir=
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggfc_14_45_ff&cd=2XzuyEtN2Y1L1Qzuzy0C0A0DzyyB0A0AtC0FyByCyCzy0CyCtN0D0Tzu0StCtDyEtBtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0CyCyD0FyDtD0AtGzztCyD0EtGyEtAtAtAtG0Ezz0BzztGtBtD0F0DyD0CtBzz0EtAyB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Bzy0Dzy0D0A0BtCtGyBzytC0EtGyEtDzytCtGzytCyB0EtG0F0ByBtD0F0DyCyCyEtB0A0F2Q&cr=960638948&ir=
SearchScopes: HKU\S-1-5-21-1313315996-2717873473-2842918071-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_secureddownload_14_46_ff&cd=2XzuyEtN2Y1L1Qzuzy0C0A0DzyyB0A0AtC0FyByCyCzy0CyCtN0D0Tzu0StCtDyEyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0D0F0D0F0CtAtAtG0AtAyEzytG0ByB0EtDtGyD0DyB0AtGtC0DtBtBtCtDyB0A0FtA0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Bzy0Dzy0D0A0BtCtGyBzytC0EtGyEtDzytCtGzytCyB0EtG0F0ByBtD0F0DyCyCyEtB0A0F2Q&cr=1160581219&ir=
SearchScopes: HKU\S-1-5-21-1313315996-2717873473-2842918071-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_secureddownload_14_46_ff&cd=2XzuyEtN2Y1L1Qzuzy0C0A0DzyyB0A0AtC0FyByCyCzy0CyCtN0D0Tzu0StCtDyEyBtN1L2XzutAtFyCtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0D0F0D0F0CtAtAtG0AtAyEzytG0ByB0EtDtGyD0DyB0AtGtC0DtBtBtCtDyB0A0FtA0F0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Bzy0Dzy0D0A0BtCtGyBzytC0EtGyEtDzytCtGzytCyB0EtG0F0ByBtD0F0DyCyCyEtB0A0F2Q&cr=1160581219&ir=
SearchScopes: HKU\S-1-5-21-1313315996-2717873473-2842918071-1000 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ggfc_14_45_ff&cd=2XzuyEtN2Y1L1Qzuzy0C0A0DzyyB0A0AtC0FyByCyCzy0CyCtN0D0Tzu0StCtDyEtBtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0CyCyD0FyDtD0AtGzztCyD0EtGyEtAtAtAtG0Ezz0BzztGtBtD0F0DyD0CtBzz0EtAyB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Bzy0Dzy0D0A0BtCtGyBzytC0EtGyEtDzytCtGzytCyB0EtG0F0ByBtD0F0DyCyCyEtB0A0F2Q&cr=960638948&ir=
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Myriam\AppData\Roaming\Mozilla\Firefox\Profiles\1zn4v21r.default
FF DefaultSearchEngine: Yahoo
FF SelectedSearchEngine: Yahoo
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Myriam\AppData\Roaming\Mozilla\Firefox\Profiles\1zn4v21r.default\user.js
FF SearchPlugin: C:\Users\Myriam\AppData\Roaming\Mozilla\Firefox\Profiles\1zn4v21r.default\searchplugins\ixquick-https.xml
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Myriam\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (TinyWallet) - C:\Users\Myriam\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcfomcpkeoocpmlfecidlblajdobehnc [2014-11-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [35328 2013-05-07] (Realtek Semiconductor Corporation) [File not signed]
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [84992 2014-01-22] () [File not signed]
R2 ClaraUpdater; C:\Program Files (x86)\Common Files\ClaraUpdater\ClaraUpdater.exe [325744 2014-11-23] (ClaraLabs)
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [714208 2014-11-13] (Cherished Technololgy LIMITED)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-04] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 lsdprn; C:\Windows\SysWOW64\lsdprn.exe [268600 2014-11-02] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 RtkBleServ; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe [42496 2013-04-25] (Realtek Semiconductor Corporation) [File not signed]
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [490640 2014-11-13] (Fuyu LIMITED)
S2 51cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll",ENT
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /svc [X]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [559320 2014-02-18] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3300568 2014-02-20] (Realtek Semiconductor Corporation )
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-11-13] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-24 15:34 - 2014-11-24 15:36 - 00022422 _____ () C:\Users\Myriam\Downloads\Addition.txt
2014-11-24 15:33 - 2014-11-24 15:37 - 00017547 _____ () C:\Users\Myriam\Downloads\FRST.txt
2014-11-24 15:33 - 2014-11-24 15:37 - 00000000 ____D () C:\FRST
2014-11-24 15:30 - 2014-11-24 15:30 - 02118144 _____ (Farbar) C:\Users\Myriam\Downloads\FRST64.exe
2014-11-24 15:29 - 2014-11-24 15:29 - 00000000 ____D () C:\Users\Myriam\Downloads\Empf von TrojanerBoard
2014-11-24 15:26 - 2014-11-24 15:26 - 00000000 _____ () C:\Users\Myriam\defogger_reenable
2014-11-23 11:49 - 2014-11-23 11:49 - 00004018 _____ () C:\Windows\System32\Tasks\LaunchSignup
2014-11-23 11:47 - 2014-11-23 11:47 - 00000000 ____D () C:\ProgramData\600440862
2014-11-23 10:06 - 2014-11-23 10:06 - 00000000 ____D () C:\Users\Myriam\AppData\Roaming\QuickScan
2014-11-23 10:05 - 2014-11-23 12:13 - 00000000 ____D () C:\Program Files (x86)\PC Speed Up
2014-11-23 10:04 - 2014-11-23 10:04 - 00000000 ____D () C:\Program Files (x86)\predm
2014-11-23 10:03 - 2014-11-23 12:14 - 00000442 __RSH () C:\ProgramData\ntuser.pol
2014-11-23 10:03 - 2014-11-23 12:14 - 00000000 ____D () C:\ProgramData\TinyWallet
2014-11-23 10:03 - 2014-11-23 12:08 - 00000000 ____D () C:\Program Files (x86)\TinyWallet
2014-11-23 10:03 - 2014-11-23 10:26 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Google
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Torch
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Comodo
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Chromatic Browser
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Torch
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Gast
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-11-23 10:03 - 2014-11-23 10:03 - 00000000 ____D () C:\Users\Administrator
2014-11-23 10:01 - 2014-11-23 12:09 - 00000000 ____D () C:\Program Files\shopperz
2014-11-23 10:01 - 2014-11-02 10:35 - 00268600 _____ () C:\Windows\SysWOW64\lsdprn.exe
2014-11-23 09:48 - 2014-11-23 09:48 - 00003150 _____ () C:\Windows\System32\Tasks\Run_Bobby_Browser
2014-11-23 09:47 - 2014-11-24 09:52 - 00000958 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2014-11-23 09:47 - 2014-11-24 09:52 - 00000954 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2014-11-23 09:47 - 2014-11-23 09:47 - 00003956 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA
2014-11-23 09:47 - 2014-11-23 09:47 - 00003702 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore
2014-11-23 09:47 - 2014-11-23 09:47 - 00000000 ____D () C:\Users\Myriam\AppData\Local\globalUpdate
2014-11-23 09:46 - 2014-11-23 09:48 - 00000000 ____D () C:\Users\Myriam\AppData\Local\BoBrowser
2014-11-23 09:46 - 2014-11-23 09:46 - 00004328 _____ () C:\Windows\System32\Tasks\RocketTab Update Task
2014-11-23 09:46 - 2014-11-23 09:46 - 00003542 _____ () C:\Windows\System32\Tasks\RocketTab
2014-11-23 09:46 - 2014-11-23 09:46 - 00000000 ____D () C:\Program Files (x86)\Search Extensions
2014-11-23 09:44 - 2014-11-23 11:56 - 00000000 ____D () C:\Program Files (x86)\FLVM Player
2014-11-23 09:35 - 2014-11-23 12:14 - 00000000 ____D () C:\Users\Myriam\AppData\Roaming\SmootherWeb
2014-11-23 09:35 - 2014-11-23 09:35 - 00001831 _____ () C:\Windows\patsearch.bin
2014-11-23 09:35 - 2014-11-23 09:35 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrT_01009.Wdf
2014-11-23 09:35 - 2014-11-23 09:35 - 00000000 ____D () C:\Users\Myriam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SmootherWeb
2014-11-23 09:35 - 2014-11-23 09:35 - 00000000 ____D () C:\Users\Myriam\AppData\Local\clicup
2014-11-23 09:35 - 2014-11-23 09:35 - 00000000 ____D () C:\SmootherWeb
2014-11-23 09:32 - 2014-11-23 09:32 - 00593992 _____ (didico conscientia argumentum meretrix) C:\Users\Myriam\Downloads\Adobe%20Flash%20Player%20IE.exe
2014-11-22 14:53 - 2014-11-22 14:53 - 09665384 _____ () C:\Users\Myriam\Documents\Regale voller GoldBarren Focus online.odt
2014-11-22 07:34 - 2014-11-22 07:34 - 00123537 _____ () C:\Users\Myriam\Documents\Kühe.odt
2014-11-22 07:30 - 2014-11-22 07:36 - 01046283 _____ () C:\Users\Myriam\Documents\Schweine.odt
2014-11-21 14:01 - 2014-11-21 14:18 - 120739128 _____ (Landesfinanzdirektion Thüringen) C:\Users\Myriam\Downloads\ElsterFormular-15.3.20141106u.exe
2014-11-19 14:28 - 2014-11-19 14:28 - 00952124 _____ () C:\Users\Myriam\Desktop\Audi Schätzung Nov'14.odt
2014-11-19 13:34 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 13:34 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 13:34 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-19 13:34 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-18 11:22 - 2014-11-18 11:22 - 00494259 _____ () C:\Users\Myriam\Desktop\NADH.odt
2014-11-18 11:10 - 2014-11-18 11:16 - 00017058 _____ () C:\Users\Myriam\Desktop\Serotonin.odt
2014-11-15 21:45 - 2014-11-15 21:45 - 00004700 _____ () C:\Users\Myriam\Downloads\Lass deine Augen das Beste sehen.odt
2014-11-13 19:46 - 2014-11-13 19:46 - 00006569 _____ () C:\Users\Myriam\Documents\Impressum.odt
2014-11-13 12:55 - 2014-11-13 12:55 - 00000000 ____D () C:\Users\Myriam\Documents\Fax
2014-11-13 12:53 - 2014-11-13 12:53 - 00792796 _____ () C:\Users\Myriam\Documents\141114 veraltete Treiber.odt
2014-11-13 12:52 - 2014-11-13 12:52 - 00223511 _____ () C:\Users\Myriam\Documents\141114 Erstattung Trixie Maulschlaufe.odt
2014-11-13 12:24 - 2014-11-13 12:24 - 00003152 _____ () C:\Windows\System32\Tasks\{D4059A91-59EB-4BD4-8D46-E7191558AA7A}
2014-11-13 12:22 - 2014-11-13 12:54 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Vosteran
2014-11-13 12:16 - 2014-11-13 12:16 - 00000000 ____D () C:\Users\Myriam\Documents\PC Speed Maximizer
2014-11-13 12:13 - 2014-11-13 12:13 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-11-13 12:12 - 2014-11-13 12:12 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-11-13 12:10 - 2014-11-13 12:10 - 05798968 _____ (Innovative Solutions ) C:\Users\Myriam\Downloads\hp-treiber.exe
2014-11-13 12:10 - 2014-11-13 12:10 - 00000000 __SHD () C:\Users\Myriam\AppData\Local\EmieBrowserModeList
2014-11-13 12:08 - 2014-11-13 12:08 - 00825248 _____ ( ) C:\Users\Myriam\Downloads\hp-treiber_setup.exe
2014-11-13 11:52 - 2014-11-13 12:12 - 00000000 ____D () C:\Users\Myriam\AppData\Roaming\DriverTurbo
2014-11-13 11:51 - 2014-11-13 11:52 - 00231952 _____ () C:\Users\Myriam\Downloads\DriverTurboSetup.exe
2014-11-12 06:55 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-12 06:55 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-12 06:55 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-12 06:55 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-12 06:55 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-12 06:55 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-12 06:55 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-12 06:55 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-12 06:55 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-12 06:55 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-12 06:55 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-12 06:55 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-12 06:55 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-12 06:55 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-12 06:55 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-12 06:55 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-12 06:55 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-12 06:55 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-12 06:55 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-12 06:55 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-12 06:55 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-12 06:55 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-12 06:55 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-12 06:55 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-12 06:55 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-12 06:55 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-12 06:55 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-12 06:55 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-12 06:55 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-12 06:55 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-12 06:55 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-12 06:55 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-12 06:55 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-12 06:55 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-12 06:55 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-12 06:55 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-12 06:55 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-12 06:55 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-12 06:55 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-12 06:55 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-12 06:55 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-12 06:55 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-12 06:55 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-12 06:55 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-12 06:55 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-12 06:55 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-12 06:55 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-12 06:55 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-12 06:55 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-12 06:55 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-12 06:55 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-12 06:55 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-12 06:55 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-12 06:55 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-12 06:55 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-12 06:55 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-12 06:53 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-12 06:53 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-12 06:53 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-12 06:53 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-12 06:53 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-12 06:53 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-12 06:53 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-12 06:53 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-12 06:53 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-12 06:53 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-12 06:53 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-12 06:53 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-12 06:48 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-12 06:48 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-12 06:48 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-12 06:48 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-12 06:48 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-12 06:48 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-12 06:48 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-12 06:48 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-12 06:48 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-12 06:48 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-12 06:48 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-12 06:48 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-12 06:48 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-12 06:48 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-12 06:48 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-12 06:48 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-12 06:48 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-12 06:48 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-12 06:48 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-12 06:48 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-12 06:48 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-12 06:48 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-12 06:48 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-12 06:48 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-12 06:48 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-12 06:48 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-12 06:48 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-12 06:48 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-12 06:48 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-12 06:48 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-12 06:48 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-12 06:48 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-12 06:48 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2014-11-11 22:54 - 2014-11-11 22:54 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-11-11 22:52 - 2014-11-11 22:54 - 13829880 _____ (Adobe Systems Inc.) C:\Users\Myriam\Downloads\Shockwave_Installer_Full.exe
2014-11-11 07:00 - 2014-11-11 07:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-10 11:57 - 2014-11-10 21:10 - 00005558 _____ () C:\Users\Myriam\Documents\Hundespiel.odt
2014-11-10 06:58 - 2014-11-10 06:58 - 00004809 _____ () C:\Users\Myriam\Documents\Kfz in der BF 6 Absatz 1 Nr.odt
2014-11-09 19:42 - 2014-11-09 19:42 - 00000000 ____D () C:\Users\Myriam\AppData\Local\PDF24
2014-11-09 19:41 - 2014-11-09 19:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-11-09 19:41 - 2014-11-09 19:41 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-11-09 10:10 - 2014-11-09 19:25 - 00005619 _____ () C:\Users\Myriam\Desktop\Liebe Devani.odt
2014-11-08 17:18 - 2014-11-08 17:18 - 00000000 ____D () C:\Program Files (x86)\downloaditkeep
2014-11-08 12:45 - 2014-11-24 09:35 - 00000094 _____ () C:\Users\Myriam\AppData\Roaming\WB.CFG
2014-11-08 12:14 - 2014-11-23 11:47 - 00000000 ____D () C:\ProgramData\374311380
2014-11-08 12:12 - 2014-11-13 12:54 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-11-08 12:09 - 2014-11-23 12:08 - 00000000 ____D () C:\ProgramData\2fa710b654abf508
2014-11-08 12:09 - 2014-11-12 06:26 - 00000000 ____D () C:\ProgramData\downloaditkeep
2014-11-08 12:09 - 2014-11-08 12:09 - 00000000 ____D () C:\ProgramData\SaleItCoupon
2014-11-08 11:49 - 2014-11-08 12:03 - 00000000 ____D () C:\Users\Myriam\AppData\Local\CUSTPDF Writer
2014-11-08 11:45 - 2014-11-24 14:45 - 00000296 _____ () C:\Windows\Tasks\Digital Sites.job
2014-11-08 11:45 - 2014-11-08 11:45 - 00003240 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-11-08 11:45 - 2014-11-08 11:45 - 00000000 ____D () C:\Users\Myriam\AppData\Roaming\DigitalSites
2014-11-08 11:39 - 2014-11-13 12:15 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Downloaded Installers
2014-11-08 11:39 - 2014-11-08 11:39 - 00000000 ____D () C:\ProgramData\SlimWare Utilities Inc
2014-11-08 11:36 - 2014-11-13 13:01 - 00000000 ____D () C:\Program Files (x86)\DriverUpdate
2014-11-08 11:36 - 2014-11-13 12:12 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-11-08 11:36 - 2014-11-08 11:36 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-11-08 11:36 - 2014-11-08 11:36 - 00000000 ____D () C:\Users\Myriam\AppData\Local\SlimWare Utilities Inc
2014-11-08 11:34 - 2014-11-08 11:34 - 00000000 ____D () C:\Users\Myriam\Documents\Optimizer Pro
2014-11-08 11:31 - 2014-11-08 11:31 - 00000000 __SHD () C:\Users\Myriam\AppData\Local\EmieUserList
2014-11-08 11:31 - 2014-11-08 11:31 - 00000000 __SHD () C:\Users\Myriam\AppData\Local\EmieSiteList
2014-11-08 11:29 - 2014-11-08 11:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Creator
2014-11-08 11:29 - 2014-11-08 11:29 - 00000000 ____D () C:\Program Files\PDFCreator
2014-11-08 11:29 - 2014-11-08 11:29 - 00000000 ____D () C:\Program Files (x86)\PDF Creator
2014-11-08 11:29 - 2014-11-08 11:29 - 00000000 ____D () C:\Program Files (x86)\GPLGS
2014-11-08 11:29 - 2011-10-04 21:43 - 00087552 _____ () C:\Windows\system32\custmon64i.dll
2014-11-08 11:25 - 2014-11-08 11:25 - 00812160 _____ ( ) C:\Users\Myriam\Downloads\PdfCreatorSetup.exe
2014-11-02 19:20 - 2014-11-02 19:22 - 00011776 ___SH () C:\Users\Myriam\Documents\Thumbs.db
2014-11-02 18:24 - 2014-11-02 19:18 - 58885280 _____ () C:\Users\Myriam\Documents\Gute Energie 141102 NutzenFußnote.pptx
2014-10-31 11:23 - 2014-10-31 11:24 - 05033168 _____ (Lenovo Group Limited ) C:\Users\Myriam\Downloads\a3ub03w7.exe
2014-10-31 07:12 - 2014-10-31 07:12 - 00000000 ____D () C:\ProgramData\EasyCash&Tax
2014-10-31 06:14 - 2014-11-20 21:32 - 00000000 ____D () C:\Users\Myriam\Documents\EC&T KontenDateien Einst
2014-10-30 22:33 - 2014-10-30 22:33 - 00003036 _____ () C:\Windows\System32\Tasks\{F21E1B53-A4BF-42A2-965F-D8F872357334}
2014-10-30 07:45 - 2014-10-30 08:19 - 00000000 ____D () C:\Users\Myriam\Programme
2014-10-29 21:58 - 2014-10-29 22:03 - 307709680 _____ () C:\Users\Myriam\Downloads\OJJ4500_Full_13.exe
2014-10-29 18:10 - 2014-10-29 18:10 - 00000000 ____D () C:\Users\Myriam\Documents\OneNote-Notizbücher
2014-10-29 12:17 - 2014-10-29 12:17 - 01825672 _____ () C:\Users\Myriam\Documents\141029 Erklärung Datenschutz.odt
2014-10-29 10:09 - 2014-10-29 10:09 - 00000000 ____D () C:\Users\Myriam\Downloads\Neuer Ordner
2014-10-29 09:37 - 2014-10-29 12:11 - 00043265 _____ () C:\Users\Myriam\Documents\Bild Löwe Regulus von Devani.odt
2014-10-28 11:32 - 2014-10-28 11:32 - 01189723 _____ () C:\Users\Myriam\Desktop\141028 Dame...Herr.odt
2014-10-27 09:28 - 2014-11-12 20:57 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-27 09:27 - 2014-11-12 20:55 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-24 15:26 - 2014-10-17 20:16 - 00000000 ____D () C:\Users\Myriam
2014-11-24 15:22 - 2014-10-18 13:18 - 00000000 ____D () C:\Users\Myriam\Documents\Outlook-Dateien
2014-11-24 14:35 - 2014-10-18 02:10 - 01751308 _____ () C:\Windows\WindowsUpdate.log
2014-11-23 18:32 - 2009-07-14 05:51 - 00033196 _____ () C:\Windows\setupact.log
2014-11-23 12:21 - 2009-07-14 05:45 - 00032768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-23 12:21 - 2009-07-14 05:45 - 00032768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-23 12:19 - 2011-04-12 08:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-11-23 12:19 - 2011-04-12 08:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-11-23 12:19 - 2009-07-14 06:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-23 12:14 - 2014-10-18 12:46 - 00222619 _____ () C:\Users\Myriam\AppData\Local\BTServer.log
2014-11-23 12:14 - 2010-11-21 04:47 - 00044576 _____ () C:\Windows\PFRO.log
2014-11-23 12:14 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-23 11:52 - 2014-04-26 08:21 - 00000000 ____D () C:\Users\Myriam\Downloads\exe Betrieb
2014-11-23 10:03 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-11-23 10:03 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-11-23 09:39 - 2014-10-18 13:03 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Adobe
2014-11-22 22:01 - 2014-10-20 13:08 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{01AB2F2F-7029-49A9-8627-BE87BF065232}
2014-11-22 07:50 - 2014-10-21 12:59 - 00000000 ____D () C:\Users\Myriam\Documents\DVDVideoSoft
2014-11-20 19:41 - 2014-10-18 12:52 - 00000000 ____D () C:\Users\Myriam\AppData\Local\Microsoft Help
2014-11-19 14:21 - 2014-10-19 15:04 - 00000416 _____ () C:\Windows\BRWMARK.INI
2014-11-19 14:21 - 2014-10-19 15:04 - 00000034 _____ () C:\Windows\SysWOW64\BD2030.DAT
2014-11-14 16:18 - 2011-04-12 08:54 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-11-13 21:50 - 2014-10-20 08:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyCash
2014-11-13 21:50 - 2014-10-20 08:07 - 00000000 ____D () C:\Program Files (x86)\EasyCash&Tax
2014-11-13 13:23 - 2014-10-20 15:21 - 00002480 _____ () C:\ProgramData\hpzinstall.log
2014-11-13 08:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-11-13 07:06 - 2014-10-18 13:04 - 00086552 _____ () C:\Users\Myriam\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-13 07:05 - 2009-07-14 05:45 - 00342576 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-13 07:03 - 2014-10-20 08:52 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-12 21:02 - 2014-10-18 12:51 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-12 06:26 - 2014-10-18 12:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-02 14:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-10-30 12:25 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-29 14:26 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

Some content of TEMP:
====================
C:\Users\Myriam\AppData\Local\Temp\18be6784_.exe
C:\Users\Myriam\AppData\Local\Temp\294823_.exe
C:\Users\Myriam\AppData\Local\Temp\6BDF3DD2-CCEB-FD7D-9453-9BAE6B457C58.dll
C:\Users\Myriam\AppData\Local\Temp\6BDF3DD2-CCEB-FD7D-9453-9BAE6B457C58.exe
C:\Users\Myriam\AppData\Local\Temp\8DC39D87-7260-3704-13E1-E3ED4E9AD4B9.exe
C:\Users\Myriam\AppData\Local\Temp\CloudBackup4115.exe
C:\Users\Myriam\AppData\Local\Temp\DllMonoCtrl.dll
C:\Users\Myriam\AppData\Local\Temp\install_flashplayer15x32_mssd_aaa_aih.exe
C:\Users\Myriam\AppData\Local\Temp\optprosetup.exe
C:\Users\Myriam\AppData\Local\Temp\scpCEE0.tmp.exe
C:\Users\Myriam\AppData\Local\Temp\scpDA0F.tmp.exe
C:\Users\Myriam\AppData\Local\Temp\sprz.exe
C:\Users\Myriam\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Myriam\AppData\Local\Temp\System.Data.SQLite50142.dll
C:\Users\Myriam\AppData\Local\Temp\System.Data.SQLite57062.dll
C:\Users\Myriam\AppData\Local\Temp\System.Data.SQLite68303.dll
C:\Users\Myriam\AppData\Local\Temp\System.Data.SQLite75878.dll
C:\Users\Myriam\AppData\Local\Temp\System.Data.SQLite90450.dll
C:\Users\Myriam\AppData\Local\Temp\System.Data.SQLite98387.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-15 00:17

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-24 15:52:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST500LM000-SSHD-8GB rev.LVD3 465.76GB
Running: Gmer-19357.exe; Driver: C:\Users\Myriam\AppData\Local\Temp\ugdiypod.sys


---- Disk sectors - GMER 2.1 ----

Disk \Device\Harddisk0\DR0 unknown MBR code
---- Processes - GMER 2.1 ----

Library c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{969E367D-5C3C-4C43-9DE0-E39E52FBB8F2}\offreg.dll (*** suspicious ***) @ c:\Program Files\Microsoft Security Client\MsMpEng.exe [940] (FILE NOT FOUND) 000007fefb930000
Process C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe (*** suspicious ***) @ C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe [3060] (BoBrowser/The BoBrowser Authors)(2014-11-23 08:46:37) 0000000001230000
Process C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe (*** suspicious ***) @ C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe [3132] (BoBrowser/The BoBrowser Authors)(2014-11-23 08:46:37) 0000000001230000
Process C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe (*** suspicious ***) @ C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe [3232] (BoBrowser/The BoBrowser Authors)(2014-11-23 08:46:37) 0000000001230000
Process C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe (*** suspicious ***) @ C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe [3312] (BoBrowser/The BoBrowser Authors)(2014-11-23 08:46:37) 0000000001230000
Process C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe (*** suspicious ***) @ C:\Users\Myriam\AppData\Local\BoBrowser\Application\bobrowser.exe [3348] (BoBrowser/The BoBrowser Authors)(2014-11-23 08:46:37) 0000000001230000

---- EOF - GMER 2.1 ----