Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 21.12.2014, 23:45   #1
scout165
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo, Ihr Spezialisten!

ich habe von einer Bekannten einen Laptop zur Behebung eines Problems "in Behandlung".
Eigentlich bemängelte sie nur, das sich keine Word/Excel-Dateien mehr öffnen lassen. Mir ist aber gleich aufgefallen, das sich das Sicherheitscenter nicht aktivieren lässt. Auf dem Laptop (HP) war eine 60 Tage Testversion von Norton installiert- ist aber schon ewig abgelaufen. Ich vermute nun das Sie seit einer Ewigkeit ohne Virenschutz im Netz unterwegs war.
Ich hoffe, ich habe mich gut vorbereitet und benötige dringend Eure Hilfe. Habe auch schon mal einen Scan mit Malewarebytes gemacht.
Logs folgen weiter unten.

Vielen Dank schon mal vorab für Eure Hilfe.

MfG Scout


FRST:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01
Ran by Isetta (administrator) on ISETTA-HP on 21-12-2014 22:30:34
Running from C:\Users\Isetta\Desktop
Loaded Profile: Isetta (Available profiles: Isetta)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Swisscom) C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(TomTom) C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586808 2011-04-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [336440 2011-06-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [DriverTurbo] => C:\Program Files (x86)\DriverTurbo\DriverTurbo.exe [6525088 2013-04-15] ()
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [EPSON SX235 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [232448 2011-01-22] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Facebook Update] => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-06-24] (Facebook Inc.)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30528608 2014-11-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\RunOnce: [Adobe Speed Launcher] => 1419189410
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: G - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: H - H:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {48966f6e-6ec4-11e2-bb3f-101f74b2fac2} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {715c2d8c-4b06-11e3-8fcb-001e101f1f81} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5eed-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5f33-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73dc-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73ec-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {980170ca-6ddc-11e2-b73a-001e101fb4df} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267111-6d3f-11e2-b58f-101f74b2fac2} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267155-6d3f-11e2-b58f-101f74b2fac2} - I:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {ebaa3d19-4713-11e3-93c5-001e101f1ed9} - I:\Autorun.exe AUTORUN=1
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {5AE9D7B8-B472-43C8-88FA-E8AF099800E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=2741FEC2-7D0B-4058-AFB7-0012EF268CAA&apn_sauid=D607FE12-53EA-44D6-B737-012D030B7E91
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM {615A1925-0E5B-4767-A65E-3165AEAC32A3} hxxp://quickscan.bitdefender.com/qsax/qsax64.cab
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-07-19] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1
Tcpip\..\Interfaces\{2036D35A-6021-4665-BF45-A144EA758D98}: [NameServer] 139.7.30.126 139.7.30.125

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @ei.VideoDownloadConverter_4z.com/Plugin -> C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISB.dll (VideoDownloadConverter)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2848928747-3939298252-169735021-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Isetta\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 SesamService; C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe [1237800 2009-02-17] (Swisscom)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [138752 2010-08-27] (Huawei Technologies Co., Ltd.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 wtsmpadap; C:\Windows\System32\DRIVERS\wtsmpadap.sys [56104 2009-01-31] (Swisscom)
R3 WtSmpFlt; C:\Windows\System32\DRIVERS\wtsmpflt.sys [383784 2009-01-31] (Swisscom)
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 rqvxcarc; \??\C:\Windows\system32\drivers\rqvxcarc.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-21 22:23 - 2014-12-21 22:24 - 00028323 _____ () C:\Users\Isetta\Desktop\Addition.txt
2014-12-21 22:22 - 2014-12-21 22:30 - 00021280 _____ () C:\Users\Isetta\Desktop\FRST.txt
2014-12-21 22:22 - 2014-12-21 22:30 - 00000000 ____D () C:\FRST
2014-12-21 22:19 - 2014-12-21 22:19 - 00380416 _____ () C:\Users\Isetta\Desktop\Gmer-19357.exe
2014-12-21 22:18 - 2014-12-21 22:18 - 02122240 _____ (Farbar) C:\Users\Isetta\Desktop\FRST64.exe
2014-12-21 21:44 - 2014-12-21 21:44 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-21 21:43 - 2014-12-21 21:43 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-21 21:43 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-21 21:43 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-21 21:43 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-21 21:42 - 2014-12-21 21:42 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Isetta\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-21 20:46 - 2014-12-21 20:46 - 01184256 _____ () C:\Users\Isetta\Downloads\MicrosoftFixit50450.msi
2014-12-21 20:16 - 2014-12-21 20:16 - 00000056 _____ () C:\Windows\setupact.log
2014-12-21 20:16 - 2014-12-21 20:16 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-21 20:15 - 2014-12-21 20:15 - 00010020 _____ () C:\Windows\PFRO.log
2014-12-21 17:29 - 2014-12-21 17:29 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-12-21 17:29 - 2014-12-21 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-21 17:28 - 2014-12-21 17:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-21 15:38 - 2014-12-21 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-21 14:43 - 2014-12-21 14:43 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\QuickScan
2014-12-21 14:06 - 2014-12-21 14:06 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-12-21 14:05 - 2014-12-21 14:05 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-12-21 14:04 - 2014-12-21 14:04 - 14107296 _____ (Microsoft Corporation) C:\Users\Isetta\Downloads\mseinstall.exe
2014-12-21 13:13 - 2014-12-21 13:19 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-21 13:13 - 2014-11-27 16:40 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-21 12:59 - 2014-12-21 13:24 - 00004453 _____ () C:\ProgramData\RUNDLL32.EXE-3460-F.txt
2014-12-21 12:50 - 2014-12-21 12:50 - 00002962 _____ () C:\Windows\System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769}
2014-12-21 11:38 - 2014-12-21 12:57 - 00013062 _____ () C:\ProgramData\RUNDLL32.EXE-5092-F.txt
2014-12-21 00:24 - 2014-12-21 00:44 - 00002629 _____ () C:\ProgramData\RUNDLL32.EXE-4056-F.txt
2014-12-19 20:46 - 2014-12-19 21:33 - 00007246 _____ () C:\ProgramData\RUNDLL32.EXE-3756-F.txt
2014-12-18 22:06 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 22:06 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-18 21:17 - 2014-12-18 23:01 - 00016086 _____ () C:\ProgramData\RUNDLL32.EXE-2624-F.txt
2014-12-12 19:47 - 2014-12-12 22:14 - 00022498 _____ () C:\ProgramData\RUNDLL32.EXE-5656-F.txt
2014-12-12 19:41 - 2014-12-12 19:41 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-12 19:23 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-12 19:23 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-11 23:53 - 2014-12-12 19:40 - 00016146 _____ () C:\ProgramData\RUNDLL32.EXE-3656-F.txt
2014-12-10 19:30 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 19:30 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 19:30 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 19:30 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 19:29 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 19:29 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 19:29 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 19:29 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 19:29 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 19:29 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 19:29 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 19:29 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 19:29 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 19:29 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 19:29 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 19:29 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 19:29 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 19:29 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 19:29 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 19:29 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 19:29 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 19:29 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 19:29 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 19:29 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 19:29 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 19:29 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 19:29 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 19:29 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 19:29 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 19:29 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 19:29 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 19:29 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 19:29 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 19:29 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 19:29 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 19:29 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 19:29 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 19:29 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 19:29 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 19:29 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 19:29 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 19:29 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 19:29 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 19:29 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 19:29 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 19:29 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 19:29 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 19:29 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 19:29 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 19:29 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 19:29 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 19:29 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 19:29 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 19:29 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 19:29 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 19:29 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 19:28 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 19:28 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 19:28 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 19:28 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 19:28 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 19:28 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 19:26 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 19:26 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-10 19:26 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 19:26 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-10 19:26 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 19:26 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 19:26 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-10 19:26 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-10 18:48 - 2014-12-11 22:49 - 00087696 _____ () C:\ProgramData\RUNDLL32.EXE-4080-F.txt
2014-12-07 22:31 - 2014-12-07 22:31 - 00000000 ____D () C:\Users\Isetta\AppData\Local\{33D6233C-631C-4C78-9150-12CBDACBEE1F}
2014-12-07 12:49 - 2014-12-07 20:41 - 00075982 _____ () C:\Users\Isetta\Documents\Fotobuch.pbf
2014-12-07 12:49 - 2014-12-07 20:40 - 00000000 ____D () C:\Users\Isetta\Documents\Fotobuch-Dateien
2014-12-07 12:21 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-12-07 12:17 - 2014-12-07 12:17 - 00001025 _____ () C:\Users\Public\Desktop\posterXXL Designer.lnk
2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\Users\Isetta\AppData\Local\posterXXL Designer
2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\posterXXL Designer
2014-12-07 12:16 - 2014-12-07 12:17 - 00000000 ____D () C:\Program Files (x86)\posterXXL Designer
2014-12-07 12:16 - 2014-12-07 12:16 - 00000000 ____D () C:\ProgramData\posterXXL Designer
2014-12-07 11:58 - 2014-12-09 22:53 - 00187502 _____ () C:\ProgramData\RUNDLL32.EXE-3660-F.txt
2014-12-04 08:10 - 2014-12-06 22:09 - 00065636 _____ () C:\ProgramData\RUNDLL32.EXE-3400-F.txt
2014-12-03 19:30 - 2014-12-03 22:20 - 00026615 _____ () C:\ProgramData\RUNDLL32.EXE-336-F.txt
2014-12-02 12:31 - 2014-12-02 22:03 - 00055916 _____ () C:\ProgramData\RUNDLL32.EXE-5372-F.txt
2014-12-01 12:45 - 2014-12-01 22:44 - 00078874 _____ () C:\ProgramData\RUNDLL32.EXE-5668-F.txt
2014-11-28 17:28 - 2014-11-28 22:16 - 00045453 _____ () C:\ProgramData\RUNDLL32.EXE-864-F.txt
2014-11-27 18:36 - 2014-11-27 22:09 - 00034185 _____ () C:\ProgramData\RUNDLL32.EXE-4092-F.txt
2014-11-26 18:15 - 2014-12-21 14:36 - 00042271 _____ () C:\ProgramData\RUNDLL32.EXE-4964-F.txt
2014-11-24 07:49 - 2014-11-25 23:01 - 00047789 _____ () C:\ProgramData\RUNDLL32.EXE-3276-F.txt
2014-11-22 23:07 - 2014-11-23 21:55 - 00036972 _____ () C:\ProgramData\RUNDLL32.EXE-3748-F.txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-21 22:14 - 2013-09-05 20:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-21 21:10 - 2014-06-24 08:05 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job
2014-12-21 21:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-12-21 20:37 - 2012-07-09 19:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-21 20:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-21 20:36 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2014-12-21 20:35 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-12-21 20:24 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-21 20:24 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-21 20:20 - 2014-01-03 19:13 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\Skype
2014-12-21 20:20 - 2011-09-15 00:40 - 01522792 _____ () C:\Windows\WindowsUpdate.log
2014-12-21 20:16 - 2012-02-20 20:41 - 00058016 _____ () C:\Users\Isetta\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-21 20:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-21 20:16 - 2009-07-14 05:45 - 00267176 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-21 17:32 - 2014-05-06 21:30 - 00000000 ____D () C:\Windows\Minidump
2014-12-21 17:32 - 2012-05-03 16:30 - 00000000 ____D () C:\Users\Isetta\AppData\Local\CrashDumps
2014-12-21 17:32 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther
2014-12-21 16:33 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-12-21 14:57 - 2014-07-09 15:34 - 00000000 ____D () C:\ProgramData\OhzazAqfug
2014-12-21 14:57 - 2014-07-09 15:34 - 00000000 ____D () C:\ProgramData\IgtahSopub
2014-12-21 14:55 - 2014-07-09 09:32 - 00000000 ____D () C:\ProgramData\6D83ADA25104713C62EBA86DEC5B9787
2014-12-21 13:46 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-21 13:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-21 13:10 - 2014-07-09 16:26 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-12-21 13:10 - 2011-07-19 10:37 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-12-21 12:56 - 2011-07-19 19:45 - 00735450 _____ () C:\Windows\system32\perfh007.dat
2014-12-21 12:56 - 2011-07-19 19:45 - 00165278 _____ () C:\Windows\system32\perfc007.dat
2014-12-21 12:50 - 2012-02-22 16:19 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\TP
2014-12-21 11:53 - 2012-02-20 20:42 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{16B80042-919F-4825-962C-0F560E7139F1}
2014-12-18 21:28 - 2014-06-12 16:03 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForIsetta
2014-12-18 21:28 - 2014-06-12 16:03 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForIsetta.job
2014-12-12 20:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-12 19:41 - 2014-05-06 21:29 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-12 19:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-12 19:18 - 2014-06-24 08:05 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job
2014-12-10 19:14 - 2013-09-05 20:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-10 19:14 - 2013-09-05 20:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-10 19:14 - 2011-07-19 10:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-03 19:34 - 2014-09-23 17:38 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-03 19:34 - 2014-01-03 19:12 - 00000000 ____D () C:\ProgramData\Skype
2014-11-30 22:28 - 2014-08-08 17:49 - 00241294 _____ () C:\ProgramData\RUNDLL32.EXE-3920-F.txt
2014-11-22 22:28 - 2014-11-20 06:29 - 00084901 _____ () C:\ProgramData\RUNDLL32.EXE-3196-F.txt

Some content of TEMP:
====================
C:\Users\Isetta\AppData\Local\Temp\ose00000.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-06 20:02

==================== End Of Log ============================
         
Addition:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2014 01
Ran by Isetta at 2014-12-21 22:31:33
Running from C:\Users\Isetta\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD System Monitor (HKLM-x32\...\{4144F415-7434-4501-97DE-CED4FAF64E7D}) (Version: 1.0.6 - Advanced Micro Devices, Inc.)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.15.0 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.4.36191 - Ask.com) <==== ATTENTION
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Druckerdeinstallation für EPSON SX235 Series (HKLM\...\EPSON SX235 Series) (Version:  - SEIKO EPSON Corporation)
Epson Easy Photo Print 2 (HKLM-x32\...\{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}) (Version: 2.2.4.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}) (Version: 2.50.0000 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{DE15C5EC-7C30-44BF-ACEB-03960FC5601D}) (Version: 1.1.1.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{D7670221-BF9B-4DFF-B26B-5BE55A87329F}) (Version: 1.2.2 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{ABEF00D0-FCAE-4E47-8D4E-D4AE5FD72B15}) (Version: 2.4.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{999164B6-5B78-4DD3-BACE-7292640AD0DD}) (Version: 3.1.0.9760 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{B446137B-18A1-4FAE-B0E4-ABE8F09705F1}) (Version: 4.1.6.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}) (Version: 6.0.5.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6319.0 - IDT)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
mobilt bredband (HKLM-x32\...\{9941ABED-87FF-413B-9E89-15F60487AEC7}_x) (Version: 2.3.1.343 - Option)
mobilt bredband (Version: 2.3.1.343 - Option) Hidden
MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
posterXXL Designer 5.3 (HKLM-x32\...\posterXXL Designer_is1) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.34.1130.2010 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.74 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0323 - REALTEK Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list restore points.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01CD728C-0F0D-4E77-8871-8E07F46FBB3B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10] (Adobe Systems Incorporated)
Task: {14460768-4127-4C46-ABA3-C2AAAC36FB53} - System32\Tasks\{E4E2C0C1-7F02-4EB0-9FFD-5B3642EA89F7} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {228C7504-7D29-415A-A71B-5A0D6A5FC04F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {2B9C4A26-BBB6-45F6-A11A-1EDD900CDB5D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {489C1D1F-6EA1-4A09-A3E2-BDC30D41B667} - System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769} => G:\SetupConsumerC2ROLW\SetupConsumerC2ROLW.exe
Task: {4EE2C4F6-5D77-4F67-B4D3-FBD06E37B7C3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {6DF4B400-48FF-431F-A192-8D1EE0DB404B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {8A365B95-91ED-4035-A7C8-9B2795609C85} - System32\Tasks\HPCeeScheduleForIsetta => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {AB27DFA1-5A10-41A8-8673-573EB0171489} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {ADB5E7E7-C4DF-4374-868C-A6F274E111FA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {B820529A-CD60-46CA-AD0F-87CE2661FABC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {B86FF47E-9F0A-424E-9D38-642FE509FE25} - System32\Tasks\{77929317-B71E-4FFD-9A41-601176702D51} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/go/help.faq.installer?LastError=1603
Task: {BD219128-8028-4F82-84B5-6146C13F5CDE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {CE621FE8-1944-4885-B142-C306BE95C44C} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-02-08] () <==== ATTENTION
Task: {E75235D9-85F8-49D7-8647-26FA431E6B8A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {F5CF6616-96EB-4E46-93AE-17CC12EE51E9} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForIsetta.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2011-07-05 10:27 - 2011-07-05 10:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-27 15:18 - 2011-06-27 15:18 - 00107320 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2011-07-05 10:27 - 2011-07-05 10:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 10:13 - 2011-07-05 10:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 12:42 - 2011-06-17 12:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00026488 _____ () C:\Program Files (x86)\MyDrive Connect\DeviceDetection.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00087416 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterBase.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00398712 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterProxy.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2848928747-3939298252-169735021-500 - Administrator - Disabled)
Gast (S-1-5-21-2848928747-3939298252-169735021-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2848928747-3939298252-169735021-1003 - Limited - Enabled)
Isetta (S-1-5-21-2848928747-3939298252-169735021-1001 - Administrator - Enabled) => C:\Users\Isetta

==================== Faulty Device Manager Devices =============

Could not list Devices. Check "winmgmt" service or repair WMI.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/21/2014 08:46:31 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,

Error: (12/21/2014 08:43:55 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,

Error: (12/21/2014 08:43:26 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (12/21/2014 08:16:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (12/21/2014 09:28:24 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 08:55:06 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 08:29:30 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 08:18:40 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 08:16:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/21/2014 08:16:57 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (12/21/2014 08:16:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HPWMISVC" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/21/2014 08:16:28 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 05:34:27 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (12/21/2014 04:38:52 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.


Microsoft Office Sessions:
=========================
Error: (12/21/2014 08:46:31 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,  (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/21/2014 08:43:55 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,  (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/21/2014 08:43:26 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,  (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (12/21/2014 08:16:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (12/21/2014 08:16:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt


==================== Memory info =========================== 

Processor: AMD A4-3300M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 33%
Total physical RAM: 5610.91 MB
Available physical RAM: 3744.51 MB
Total Pagefile: 11219.99 MB
Available Pagefile: 9005.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:445.89 GB) (Free:396.52 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.71 GB) (Free:1.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.1 GB) FAT32
Drive f: (16 Aug 2012) (CDROM) (Total:0.69 GB) (Free:0.65 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1ECE8725)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=445.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)

==================== End Of Log ============================
         
Gmer:
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-21 23:00:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000070 ST950032 rev.0005 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Isetta\AppData\Local\Temp\fwdcqpow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                       fffff800031a2000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                       fffff800031a202f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17           00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17             00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17           00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42           00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                      * 9
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17              00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17       00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17              00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17       00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17             00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                  00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17           00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17             00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17             00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17           00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20       00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[3528] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31       00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                         00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                           00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                         00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                         00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                      * 9
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                            00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                     00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                            00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                     00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                           00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                         00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                           00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                              00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                           00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                         00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                     00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                     00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                      * 9
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3644] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                 00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                   00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                 00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                 00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                      * 9
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                    00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17             00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                    00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17             00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                   00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                        00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                 00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                   00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                      00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                   00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                 00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20             00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31             00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                  00000000772a1401 2 bytes JMP 7653b21b C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                    00000000772a1419 2 bytes JMP 7653b346 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                  00000000772a1431 2 bytes JMP 765b8ea9 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                  00000000772a144a 2 bytes CALL 765148ad C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                      * 9
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                     00000000772a14dd 2 bytes JMP 765b87a2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17              00000000772a14f5 2 bytes JMP 765b8978 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                     00000000772a150d 2 bytes JMP 765b8698 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17              00000000772a1525 2 bytes JMP 765b8a62 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                    00000000772a153d 2 bytes JMP 7652fca8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                         00000000772a1555 2 bytes JMP 765368ef C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                  00000000772a156d 2 bytes JMP 765b8f61 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                    00000000772a1585 2 bytes JMP 765b8ac2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                       00000000772a159d 2 bytes JMP 765b865c C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                    00000000772a15b5 2 bytes JMP 7652fd41 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                  00000000772a15cd 2 bytes JMP 7653b2dc C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20              00000000772a16b2 2 bytes JMP 765b8e24 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31              00000000772a16bd 2 bytes JMP 765b85f1 C:\Windows\syswow64\kernel32.dll
?         C:\Windows\system32\mssprxy.dll [2800] entry point in ".rdata" section                                                                   00000000741b71e6

---- EOF - GMER 2.1 ----
         
Malewarebytes:
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.12.2014
Suchlauf-Zeit: 21:44:51
Logdatei: Malwarebytes-log.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.21.04
Rootkit Datenbank: v2014.12.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Isetta

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 323372
Verstrichene Zeit: 28 Min, 31 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 31
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6C434537-053E-486D-B62A-160059D9D456}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6C434537-053E-486D-B62A-160059D9D456}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd.1, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\GenericAskToolbar.ToolbarWnd, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\GenericAskToolbar.ToolbarWnd.1, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.RegCleanerPro.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\RegClean Pro, , [77017ee7d1ab3006550e4f66f113bc44], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{38122a36-83b2-46b8-b39a-ec72a4614a07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{fc39a9f4-77ff-4595-bdec-8b768c481257}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{CA021789-C8CD-4676-BC40-90077A19D5CD}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FB32408C-E182-443C-B15E-1E3C721E29EC}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{CA021789-C8CD-4676-BC40-90077A19D5CD}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FB32408C-E182-443C-B15E-1E3C721E29EC}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{fc39a9f4-77ff-4595-bdec-8b768c481257}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\VideoDownloadConverter_4zInstaller.Start.1, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\VideoDownloadConverter_4zInstaller.Start, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\VideoDownloadConverter_4zInstaller.Start, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\VideoDownloadConverter_4zInstaller.Start.1, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{38122A36-83B2-46B8-B39A-EC72A4614A07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{38122A36-83B2-46B8-B39A-EC72A4614A07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 

Registrierungswerte: 3
PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{00000000-6E41-4FD3-8538-502F5495E5FC}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [4434e18497e5cc6aba39a56ce0238b75], 

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 7
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\setups, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI, , [d99f76ef15675fd7ea1b3003b64d946c], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr, , [d99f76ef15675fd7ea1b3003b64d946c], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache, , [d99f76ef15675fd7ea1b3003b64d946c], 

Dateien: 7
PUP.Optional.FrostwireTB.A, C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.AdvancedSystemProtector, C:\Windows\System32\sasnative64.exe, , [195f2441522ae15538626c4fd928fe02], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\009DE561.exe, , [d99f76ef15675fd7ea1b3003b64d946c], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\files.ini, , [d99f76ef15675fd7ea1b3003b64d946c], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

Alt 22.12.2014, 00:13   #2
Bootsektor
Ruhe in Frieden
† 2019
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo,

ja da ist noch was zu sehen. Hat Malwarebytes was gefunden?
  • Starte Malwarebytes
  • Gehe nun oben auf Verlauf
  • links findest du nun die Auswahl Quarantäne und Anwendungsprotokolle
  • Gehe auf Anwendungsprotokolle
  • suche hier das letzte Suchlaufsprotokoll und wähle das aus
  • nun gehe oben auf Ansicht, das Protokoll öffnet sich
  • unten links steht exportieren, wähle das aus und klicke auf Textdatei
  • speichere nun das Log unter mbam.txt ab
  • öffne das Log mit deinem Texteditor
  • poste mir den Inhalt

Bitte auf jeden Fall sämtliche Passwörter von einem sauberen PC ändern, keine Aktionen wie Onlinebanking vom Laptop bis die Bereinigung abgeschlossen ist.

(Entschuldige hatte das MBAM-Log nicht gesehen )
__________________

__________________

Alt 22.12.2014, 00:22   #3
scout165
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo,

hier nochmal die Log von Malwarebytes:

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.12.2014
Suchlauf-Zeit: 21:44:51
Logdatei: Malwarebytes-log1.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.21.04
Rootkit Datenbank: v2014.12.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Isetta

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 323372
Verstrichene Zeit: 28 Min, 31 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 31
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6C434537-053E-486D-B62A-160059D9D456}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6C434537-053E-486D-B62A-160059D9D456}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd.1, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\GenericAskToolbar.ToolbarWnd, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\GenericAskToolbar.ToolbarWnd.1, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.RegCleanerPro.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\RegClean Pro, , [77017ee7d1ab3006550e4f66f113bc44], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{38122a36-83b2-46b8-b39a-ec72a4614a07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{fc39a9f4-77ff-4595-bdec-8b768c481257}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{CA021789-C8CD-4676-BC40-90077A19D5CD}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FB32408C-E182-443C-B15E-1E3C721E29EC}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{CA021789-C8CD-4676-BC40-90077A19D5CD}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FB32408C-E182-443C-B15E-1E3C721E29EC}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{fc39a9f4-77ff-4595-bdec-8b768c481257}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\VideoDownloadConverter_4zInstaller.Start.1, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\CLASSES\VideoDownloadConverter_4zInstaller.Start, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\VideoDownloadConverter_4zInstaller.Start, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\VideoDownloadConverter_4zInstaller.Start.1, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{38122A36-83B2-46B8-B39A-EC72A4614A07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{38122A36-83B2-46B8-B39A-EC72A4614A07}, , [3d3bfb6a2d4fe35330730e1bbb480df3], 

Registrierungswerte: 3
PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-2848928747-3939298252-169735021-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{00000000-6E41-4FD3-8538-502F5495E5FC}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{D4027C7F-154A-4066-A1AD-4243D8127440}, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{D4027C7F-154A-4066-A1AD-4243D8127440}, , [4434e18497e5cc6aba39a56ce0238b75], 

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 7
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\setups, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI, , [d99f76ef15675fd7ea1b3003b64d946c], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr, , [d99f76ef15675fd7ea1b3003b64d946c], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache, , [d99f76ef15675fd7ea1b3003b64d946c], 

Dateien: 7
PUP.Optional.FrostwireTB.A, C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll, , [d1a7e77efb81a88e1bd843ce8083f709], 
PUP.Optional.AdvancedSystemProtector, C:\Windows\System32\sasnative64.exe, , [195f2441522ae15538626c4fd928fe02], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll, , [3d3bfb6a2d4fe35330730e1bbb480df3], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\009DE561.exe, , [d99f76ef15675fd7ea1b3003b64d946c], 
PUP.Optional.MindSpark.A, C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\files.ini, , [d99f76ef15675fd7ea1b3003b64d946c], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         
MfG scout
__________________

Alt 22.12.2014, 00:26   #4
Bootsektor
Ruhe in Frieden
† 2019
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Siehe obigen Post, Passwörter vom sauberen Rechner aus ändern, kein Onlinebanking bis fertig.

Weswegen hast du das Fix-it durchgeführt? Sei vorsichtig mit Registrycleanern, die können dir das System zerschießen.

Schritt 1
Bitte deinstalliere folgende Programme (falls vorhanden) :
Ask Toolbar
Ask Toolbar Updater

Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Programm auswählen --> entfernen

Falls du ein Programm nicht deinstallieren kannst, lade dir von hier den Revo-uninstaller herunter und deinstalliere es damit, wähle dabei den moderaten Modus.

Schritt 2

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
C:\ProgramData\RUNDLL32.EXE-*.txt
C:\ProgramData\OhzazAqfug
C:\ProgramData\IgtahSopub
C:\ProgramData\6D83ADA25104713C62EBA86DEC5B9787
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 3
Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.




Schritt 4
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

Alt 22.12.2014, 01:15   #5
scout165
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo Bootsektor,

auf der Microsoft Support-Seite wird diese Lösung angeboten.
Code:
ATTFilter
hxxp://support.microsoft.com/kb/2519899/de
         
Deshalb Fix-It.

Schritt 1:
Ask Toolbar und Updater habe ich deinstalliert - mit Revo-Uninstaller.

Schritt 2:
Fixlist habe ich erstellt, dann FRST mit Fix-Button ausgeführt.
Hier die Log:

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-12-2014 01
Ran by Isetta at 2014-12-22 00:44:32 Run:1
Running from C:\Users\Isetta\Desktop
Loaded Profiles: Isetta &  (Available profiles: Isetta)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\ProgramData\RUNDLL32.EXE-*.txt
C:\ProgramData\OhzazAqfug
C:\ProgramData\IgtahSopub
C:\ProgramData\6D83ADA25104713C62EBA86DEC5B9787
*****************

C:\ProgramData\RUNDLL32.EXE-*.txt => Moved successfully.
C:\ProgramData\OhzazAqfug => Moved successfully.
C:\ProgramData\IgtahSopub => Moved successfully.
C:\ProgramData\6D83ADA25104713C62EBA86DEC5B9787 => Moved successfully.
         
Schritt 3:
Der Scan mit FSS, hier die Log:

Code:
ATTFilter
Farbar Service Scanner Version: 21-07-2014
Ran by Isetta (administrator) on 22-12-2014 at 00:49:29
Running from "C:\Users\Isetta\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.

winmgmt Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open winmgmt registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open winmgmt registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open winmgmt registry key. The service key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****
         
Schritt 4:
Der erneute Scan mit FRST.
Die Log:

FRST

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01
Ran by Isetta (administrator) on ISETTA-HP on 22-12-2014 00:52:15
Running from C:\Users\Isetta\Desktop
Loaded Profile: Isetta (Available profiles: Isetta)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Swisscom) C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(TomTom) C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586808 2011-04-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [336440 2011-06-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [DriverTurbo] => C:\Program Files (x86)\DriverTurbo\DriverTurbo.exe [6525088 2013-04-15] ()
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [EPSON SX235 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [232448 2011-01-22] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Facebook Update] => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-06-24] (Facebook Inc.)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30528608 2014-11-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\RunOnce: [Adobe Speed Launcher] => 1419200165
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: G - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: H - H:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {48966f6e-6ec4-11e2-bb3f-101f74b2fac2} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {715c2d8c-4b06-11e3-8fcb-001e101f1f81} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5eed-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5f33-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73dc-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73ec-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {980170ca-6ddc-11e2-b73a-001e101fb4df} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267111-6d3f-11e2-b58f-101f74b2fac2} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267155-6d3f-11e2-b58f-101f74b2fac2} - I:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {ebaa3d19-4713-11e3-93c5-001e101f1ed9} - I:\Autorun.exe AUTORUN=1
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {5AE9D7B8-B472-43C8-88FA-E8AF099800E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=2741FEC2-7D0B-4058-AFB7-0012EF268CAA&apn_sauid=D607FE12-53EA-44D6-B737-012D030B7E91
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM {615A1925-0E5B-4767-A65E-3165AEAC32A3} hxxp://quickscan.bitdefender.com/qsax/qsax64.cab
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-07-19] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1
Tcpip\..\Interfaces\{2036D35A-6021-4665-BF45-A144EA758D98}: [NameServer] 139.7.30.126 139.7.30.125

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @ei.VideoDownloadConverter_4z.com/Plugin -> C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISB.dll (VideoDownloadConverter)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2848928747-3939298252-169735021-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Isetta\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 SesamService; C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe [1237800 2009-02-17] (Swisscom)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [138752 2010-08-27] (Huawei Technologies Co., Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 wtsmpadap; C:\Windows\System32\DRIVERS\wtsmpadap.sys [56104 2009-01-31] (Swisscom)
R3 WtSmpFlt; C:\Windows\System32\DRIVERS\wtsmpflt.sys [383784 2009-01-31] (Swisscom)
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 rqvxcarc; \??\C:\Windows\system32\drivers\rqvxcarc.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-22 00:52 - 2014-12-22 00:52 - 00020670 _____ () C:\Users\Isetta\Desktop\FRST.txt
2014-12-22 00:49 - 2014-12-22 00:49 - 00003326 _____ () C:\Users\Isetta\Desktop\FSS.txt
2014-12-22 00:48 - 2014-12-22 00:48 - 00415232 _____ (Farbar) C:\Users\Isetta\Desktop\FSS.exe
2014-12-22 00:36 - 2014-12-22 00:36 - 00001224 _____ () C:\Users\Isetta\Desktop\Revo Uninstaller.lnk
2014-12-22 00:36 - 2014-12-22 00:36 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-12-21 23:15 - 2014-12-21 23:15 - 00275048 _____ () C:\Windows\Minidump\122114-42011-01.dmp
2014-12-21 23:14 - 2014-12-21 23:14 - 644719268 _____ () C:\Windows\MEMORY.DMP
2014-12-21 23:00 - 2014-12-21 23:00 - 00020343 _____ () C:\Users\Isetta\Desktop\Gmer-log.log
2014-12-21 22:23 - 2014-12-21 22:32 - 00028323 _____ () C:\Users\Isetta\Desktop\Addition_1.txt
2014-12-21 22:22 - 2014-12-22 00:52 - 00000000 ____D () C:\FRST
2014-12-21 22:22 - 2014-12-21 22:32 - 00042516 _____ () C:\Users\Isetta\Desktop\FRST_1.txt
2014-12-21 22:19 - 2014-12-21 22:19 - 00380416 _____ () C:\Users\Isetta\Desktop\Gmer-19357.exe
2014-12-21 22:18 - 2014-12-21 22:18 - 02122240 _____ (Farbar) C:\Users\Isetta\Desktop\FRST64.exe
2014-12-21 21:44 - 2014-12-22 00:15 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-21 21:43 - 2014-12-21 21:43 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-21 21:43 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-21 21:43 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-21 21:43 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-21 21:42 - 2014-12-21 21:42 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Isetta\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-21 20:46 - 2014-12-21 20:46 - 01184256 _____ () C:\Users\Isetta\Downloads\MicrosoftFixit50450.msi
2014-12-21 20:16 - 2014-12-21 23:15 - 00000112 _____ () C:\Windows\setupact.log
2014-12-21 20:16 - 2014-12-21 20:16 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-21 20:15 - 2014-12-21 23:14 - 00017456 _____ () C:\Windows\PFRO.log
2014-12-21 17:29 - 2014-12-21 17:29 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-12-21 17:29 - 2014-12-21 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-21 17:28 - 2014-12-21 17:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-21 15:38 - 2014-12-21 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-21 14:43 - 2014-12-21 14:43 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\QuickScan
2014-12-21 14:06 - 2014-12-21 14:06 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-12-21 14:05 - 2014-12-21 14:05 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-12-21 14:04 - 2014-12-21 14:04 - 14107296 _____ (Microsoft Corporation) C:\Users\Isetta\Downloads\mseinstall.exe
2014-12-21 13:13 - 2014-12-21 13:19 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-21 13:13 - 2014-11-27 16:40 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-21 12:50 - 2014-12-21 12:50 - 00002962 _____ () C:\Windows\System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769}
2014-12-18 22:06 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 22:06 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-12 19:41 - 2014-12-12 19:41 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-12 19:23 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-12 19:23 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-10 19:30 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 19:30 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 19:30 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 19:30 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 19:29 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 19:29 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 19:29 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 19:29 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 19:29 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 19:29 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 19:29 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 19:29 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 19:29 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 19:29 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 19:29 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 19:29 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 19:29 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 19:29 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 19:29 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 19:29 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 19:29 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 19:29 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 19:29 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 19:29 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 19:29 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 19:29 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 19:29 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 19:29 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 19:29 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 19:29 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 19:29 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 19:29 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 19:29 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 19:29 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 19:29 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 19:29 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 19:29 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 19:29 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 19:29 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 19:29 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 19:29 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 19:29 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 19:29 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 19:29 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 19:29 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 19:29 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 19:29 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 19:29 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 19:29 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 19:29 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 19:29 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 19:29 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 19:29 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 19:29 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 19:29 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 19:29 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 19:28 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 19:28 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 19:28 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 19:28 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 19:28 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 19:28 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 19:26 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 19:26 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-10 19:26 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 19:26 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-10 19:26 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 19:26 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 19:26 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-10 19:26 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-07 22:31 - 2014-12-07 22:31 - 00000000 ____D () C:\Users\Isetta\AppData\Local\{33D6233C-631C-4C78-9150-12CBDACBEE1F}
2014-12-07 12:49 - 2014-12-07 20:41 - 00075982 _____ () C:\Users\Isetta\Documents\Fotobuch.pbf
2014-12-07 12:49 - 2014-12-07 20:40 - 00000000 ____D () C:\Users\Isetta\Documents\Fotobuch-Dateien
2014-12-07 12:21 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-12-07 12:17 - 2014-12-07 12:17 - 00001025 _____ () C:\Users\Public\Desktop\posterXXL Designer.lnk
2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\Users\Isetta\AppData\Local\posterXXL Designer
2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\posterXXL Designer
2014-12-07 12:16 - 2014-12-07 12:17 - 00000000 ____D () C:\Program Files (x86)\posterXXL Designer
2014-12-07 12:16 - 2014-12-07 12:16 - 00000000 ____D () C:\ProgramData\posterXXL Designer

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-22 00:38 - 2011-09-15 00:40 - 01526232 _____ () C:\Windows\WindowsUpdate.log
2014-12-22 00:14 - 2013-09-05 20:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-22 00:10 - 2014-06-24 08:05 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job
2014-12-21 23:54 - 2014-01-03 19:13 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\Skype
2014-12-21 23:28 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-21 23:28 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-21 23:15 - 2014-05-06 21:30 - 00000000 ____D () C:\Windows\Minidump
2014-12-21 23:15 - 2012-02-20 20:41 - 00058016 _____ () C:\Users\Isetta\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-21 23:15 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-21 23:15 - 2009-07-14 05:45 - 00267176 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-21 23:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-21 22:46 - 2012-05-03 16:30 - 00000000 ____D () C:\Users\Isetta\AppData\Local\CrashDumps
2014-12-21 21:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-12-21 20:37 - 2012-07-09 19:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-21 20:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-21 20:36 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2014-12-21 20:35 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-12-21 17:32 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther
2014-12-21 16:33 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-12-21 13:46 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-21 13:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-21 13:10 - 2014-07-09 16:26 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-12-21 13:10 - 2011-07-19 10:37 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-12-21 12:56 - 2011-07-19 19:45 - 00735450 _____ () C:\Windows\system32\perfh007.dat
2014-12-21 12:56 - 2011-07-19 19:45 - 00165278 _____ () C:\Windows\system32\perfc007.dat
2014-12-21 12:50 - 2012-02-22 16:19 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\TP
2014-12-21 11:53 - 2012-02-20 20:42 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{16B80042-919F-4825-962C-0F560E7139F1}
2014-12-18 21:28 - 2014-06-12 16:03 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForIsetta
2014-12-18 21:28 - 2014-06-12 16:03 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForIsetta.job
2014-12-12 20:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-12 19:41 - 2014-05-06 21:29 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-12 19:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-12 19:18 - 2014-06-24 08:05 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job
2014-12-10 19:14 - 2013-09-05 20:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-10 19:14 - 2013-09-05 20:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-10 19:14 - 2011-07-19 10:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-03 19:34 - 2014-09-23 17:38 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-03 19:34 - 2014-01-03 19:12 - 00000000 ____D () C:\ProgramData\Skype

Some content of TEMP:
====================
C:\Users\Isetta\AppData\Local\Temp\ose00000.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-06 20:02

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---

--- --- ---


Addition:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2014 01
Ran by Isetta at 2014-12-22 00:53:15
Running from C:\Users\Isetta\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD System Monitor (HKLM-x32\...\{4144F415-7434-4501-97DE-CED4FAF64E7D}) (Version: 1.0.6 - Advanced Micro Devices, Inc.)
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Druckerdeinstallation für EPSON SX235 Series (HKLM\...\EPSON SX235 Series) (Version:  - SEIKO EPSON Corporation)
Epson Easy Photo Print 2 (HKLM-x32\...\{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}) (Version: 2.2.4.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}) (Version: 2.50.0000 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{DE15C5EC-7C30-44BF-ACEB-03960FC5601D}) (Version: 1.1.1.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{D7670221-BF9B-4DFF-B26B-5BE55A87329F}) (Version: 1.2.2 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{ABEF00D0-FCAE-4E47-8D4E-D4AE5FD72B15}) (Version: 2.4.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{999164B6-5B78-4DD3-BACE-7292640AD0DD}) (Version: 3.1.0.9760 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{B446137B-18A1-4FAE-B0E4-ABE8F09705F1}) (Version: 4.1.6.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}) (Version: 6.0.5.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6319.0 - IDT)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
mobilt bredband (HKLM-x32\...\{9941ABED-87FF-413B-9E89-15F60487AEC7}_x) (Version: 2.3.1.343 - Option)
mobilt bredband (Version: 2.3.1.343 - Option) Hidden
MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
posterXXL Designer 5.3 (HKLM-x32\...\posterXXL Designer_is1) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.34.1130.2010 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.74 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0323 - REALTEK Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list restore points.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01CD728C-0F0D-4E77-8871-8E07F46FBB3B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10] (Adobe Systems Incorporated)
Task: {14460768-4127-4C46-ABA3-C2AAAC36FB53} - System32\Tasks\{E4E2C0C1-7F02-4EB0-9FFD-5B3642EA89F7} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {228C7504-7D29-415A-A71B-5A0D6A5FC04F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {2B9C4A26-BBB6-45F6-A11A-1EDD900CDB5D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {489C1D1F-6EA1-4A09-A3E2-BDC30D41B667} - System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769} => G:\SetupConsumerC2ROLW\SetupConsumerC2ROLW.exe [2011-09-04] (Microsoft Corporation)
Task: {4EE2C4F6-5D77-4F67-B4D3-FBD06E37B7C3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {6DF4B400-48FF-431F-A192-8D1EE0DB404B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {8A365B95-91ED-4035-A7C8-9B2795609C85} - System32\Tasks\HPCeeScheduleForIsetta => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {AB27DFA1-5A10-41A8-8673-573EB0171489} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {ADB5E7E7-C4DF-4374-868C-A6F274E111FA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {B820529A-CD60-46CA-AD0F-87CE2661FABC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {B86FF47E-9F0A-424E-9D38-642FE509FE25} - System32\Tasks\{77929317-B71E-4FFD-9A41-601176702D51} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/go/help.faq.installer?LastError=1603
Task: {BD219128-8028-4F82-84B5-6146C13F5CDE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {CE621FE8-1944-4885-B142-C306BE95C44C} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ATTENTION
Task: {E75235D9-85F8-49D7-8647-26FA431E6B8A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {F5CF6616-96EB-4E46-93AE-17CC12EE51E9} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForIsetta.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2011-07-05 10:27 - 2011-07-05 10:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-27 15:18 - 2011-06-27 15:18 - 00107320 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2011-07-05 10:27 - 2011-07-05 10:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 10:13 - 2011-07-05 10:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 12:42 - 2011-06-17 12:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00026488 _____ () C:\Program Files (x86)\MyDrive Connect\DeviceDetection.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00087416 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterBase.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00398712 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterProxy.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2848928747-3939298252-169735021-500 - Administrator - Disabled)
Gast (S-1-5-21-2848928747-3939298252-169735021-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2848928747-3939298252-169735021-1003 - Limited - Enabled)
Isetta (S-1-5-21-2848928747-3939298252-169735021-1001 - Administrator - Enabled) => C:\Users\Isetta

==================== Faulty Device Manager Devices =============

Could not list Devices. Check "winmgmt" service or repair WMI.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/21/2014 11:16:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: HPWMISVC.exe, Version: 2.3.1.0, Zeitstempel: 0x4d9e7ce7
Name des fehlerhaften Moduls: HPWMISVC.exe, Version: 2.3.1.0, Zeitstempel: 0x4d9e7ce7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000016d1
ID des fehlerhaften Prozesses: 0x4c0
Startzeit der fehlerhaften Anwendung: 0xHPWMISVC.exe0
Pfad der fehlerhaften Anwendung: HPWMISVC.exe1
Pfad des fehlerhaften Moduls: HPWMISVC.exe2
Berichtskennung: HPWMISVC.exe3

Error: (12/21/2014 10:45:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000409
Fehleroffset: 0x000728d6
ID des fehlerhaften Prozesses: 0x88c
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3

Error: (12/21/2014 08:46:31 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,

Error: (12/21/2014 08:43:55 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,

Error: (12/21/2014 08:43:26 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (12/21/2014 08:16:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (12/22/2014 00:07:22 AM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 11:17:45 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 11:17:38 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 11:16:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HPWMISVC" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/21/2014 11:15:33 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 11:15:26 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000109 (0xa3a039d8990cf506, 0xb3b7465eeb8b3340, 0xfffff880009f4540, 0x0000000000000002)C:\Windows\MEMORY.DMP122114-42011-01

Error: (12/21/2014 11:15:25 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎21.‎12.‎2014 um 23:13:02 unerwartet heruntergefahren.

Error: (12/21/2014 09:28:24 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 08:55:06 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/21/2014 08:29:30 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.


Microsoft Office Sessions:
=========================
Error: (12/21/2014 11:16:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: HPWMISVC.exe2.3.1.04d9e7ce7HPWMISVC.exe2.3.1.04d9e7ce7c0000005000016d14c001d01d6ba345297eC:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exeC:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exef2e86ee5-895e-11e4-a66f-00ade1ac1c1a

Error: (12/21/2014 10:45:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000409000728d688c01d01d65e8d7fec1C:\Users\Isetta\Desktop\Gmer-19357.exeC:\Users\Isetta\Desktop\Gmer-19357.exeb54a979f-895a-11e4-8a4d-00ade1ac1c1a

Error: (12/21/2014 08:46:31 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,  (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/21/2014 08:43:55 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,  (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/21/2014 08:43:26 PM) (Source: MsiInstaller) (EventID: 11720) (User: Isetta-HP)
Description: Produkt: Microsoft Fix it 50450 -- Fehler 1720. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Skript konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Benutzerdefinierte Aktion: ProcessCheck Skriptfehler -2147023836, :  Zeile18, Spalte 1,  (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (12/21/2014 08:16:57 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (12/21/2014 08:16:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore


==================== Memory info =========================== 

Processor: AMD A4-3300M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 28%
Total physical RAM: 5610.91 MB
Available physical RAM: 3996.36 MB
Total Pagefile: 11219.99 MB
Available Pagefile: 9340.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:445.89 GB) (Free:394.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.71 GB) (Free:1.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.1 GB) FAT32
Drive f: (16 Aug 2012) (CDROM) (Total:0.69 GB) (Free:0.65 GB) UDF
Drive g: (OCTAGON) (Removable) (Total:1.92 GB) (Free:1.91 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1ECE8725)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=445.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)

========================================================
Disk: 1 (Size: 1.9 GB) (Disk ID: 6B0F8176)
Partition 1: (Active) - (Size=1.9 GB) - (Type=0B)

==================== End Of Log ============================
         
MfG scout


Alt 22.12.2014, 23:48   #6
Bootsektor
Ruhe in Frieden
† 2019
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo scout,

danke für die Information,

dann gehts nun so weiter.

Gibt es nach diesen Schritten noch Probleme?
Schritt 1
Bitte lade Dir von hier die Winmgmt.reg Datei herunter und führe sie aus. Mache danach einen Neustart.

Schritt 2
Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.




Schritt 3
Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 4
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.
__________________
--> Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz

Alt 23.12.2014, 00:14   #7
scout165
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo Bootsektor,

danke, das du dich heute noch gemeldet hast.

Schritt 1:

Erledigt. Nach dem Neustart ist das Sicherheitscenter wieder aktiv, ist auch in den Diensten gestartet.

Schritt 2:

Scan erledigt- Hier die Log:

Code:
ATTFilter
Farbar Service Scanner Version: 21-07-2014
Ran by Isetta (administrator) on 23-12-2014 at 00:05:44
Running from "C:\Users\Isetta\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****
         
Schritt 3:

in Arbeit....

MfG scout

Alt 23.12.2014, 00:16   #8
Bootsektor
Ruhe in Frieden
† 2019
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Ja, kann dauern... muss aber nicht (also dass es dauert)

Alt 23.12.2014, 06:01   #9
scout165
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hat dann doch etwas gedauert.

Schritt 3:

Scan mit ESET beendet-4 Elemente wurden gefunden.
Hier die Log:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=8d1f3fd2479bb442ab1ed55c357f2ebe
# engine=21674
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-23 03:03:52
# local_time=2014-12-23 04:03:52 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 140274 42284226 0 0
# scanned=168564
# found=4
# cleaned=0
# scan_time=13415
sh=7663AE90AAF7DB12B279E3F2B95C42631008B2B2 ft=1 fh=d33992596aff3bc1 vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll"
sh=9DA2AD02F4054F35742467833D6F4A3BD27AA5DC ft=1 fh=acb533ff91c24631 vn="Variante von Win32/Toolbar.MyWebSearch.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll"
sh=722F2485901EC3212F967BE59489B0F6D4DB161D ft=1 fh=8751e082e3471355 vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll"
sh=8FC38D5B42AF3BE98C21081ED8868DDDB0A27312 ft=1 fh=4cbc6feeae54d0db vn="Variante von Win32/Toolbar.MyWebSearch.O evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\009DE561.exe"
         
Schritt 4:

Scan mit FRST erledigt.
Hier die Logs:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01
Ran by Isetta (administrator) on ISETTA-HP on 23-12-2014 05:47:36
Running from C:\Users\Isetta\Desktop
Loaded Profile: Isetta (Available profiles: Isetta)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Swisscom) C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(TomTom) C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586808 2011-04-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [336440 2011-06-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [DriverTurbo] => C:\Program Files (x86)\DriverTurbo\DriverTurbo.exe [6525088 2013-04-15] ()
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [EPSON SX235 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [232448 2011-01-22] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-08-22] (TomTom)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Facebook Update] => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-06-24] (Facebook Inc.)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30528608 2014-11-27] (Skype Technologies S.A.)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\RunOnce: [Adobe Speed Launcher] => 1419289339
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: G - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: H - H:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {48966f6e-6ec4-11e2-bb3f-101f74b2fac2} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {715c2d8c-4b06-11e3-8fcb-001e101f1f81} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5eed-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {81ac5f33-457e-11e3-8215-101f74b2fac2} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73dc-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {830e73ec-45e0-11e3-b5ae-001e101f63cf} - G:\Autorun.exe AUTORUN=1
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {980170ca-6ddc-11e2-b73a-001e101fb4df} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267111-6d3f-11e2-b58f-101f74b2fac2} - G:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {9f267155-6d3f-11e2-b58f-101f74b2fac2} - I:\AutoRun.exe
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\...\MountPoints2: {ebaa3d19-4713-11e3-93c5-001e101f1ed9} - I:\Autorun.exe AUTORUN=1
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-2848928747-3939298252-169735021-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {5AE9D7B8-B472-43C8-88FA-E8AF099800E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=2741FEC2-7D0B-4058-AFB7-0012EF268CAA&apn_sauid=D607FE12-53EA-44D6-B737-012D030B7E91
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} ->  No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM {615A1925-0E5B-4767-A65E-3165AEAC32A3} hxxp://quickscan.bitdefender.com/qsax/qsax64.cab
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-07-19] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1
Tcpip\..\Interfaces\{2036D35A-6021-4665-BF45-A144EA758D98}: [NameServer] 139.7.30.126 139.7.30.125

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @ei.VideoDownloadConverter_4z.com/Plugin -> C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISB.dll (VideoDownloadConverter)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2848928747-3939298252-169735021-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Isetta\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 SesamService; C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe [1237800 2009-02-17] (Swisscom)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [138752 2010-08-27] (Huawei Technologies Co., Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 wtsmpadap; C:\Windows\System32\DRIVERS\wtsmpadap.sys [56104 2009-01-31] (Swisscom)
R3 WtSmpFlt; C:\Windows\System32\DRIVERS\wtsmpflt.sys [383784 2009-01-31] (Swisscom)
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 rqvxcarc; \??\C:\Windows\system32\drivers\rqvxcarc.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-23 05:47 - 2014-12-23 05:48 - 00021645 _____ () C:\Users\Isetta\Desktop\FRST.txt
2014-12-23 05:43 - 2014-12-23 05:43 - 00000580 _____ () C:\Users\Isetta\Desktop\Liste.txt
2014-12-23 00:15 - 2014-12-23 00:15 - 02347384 _____ (ESET) C:\Users\Isetta\Desktop\esetsmartinstaller_deu.exe
2014-12-23 00:15 - 2014-12-23 00:15 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-12-23 00:05 - 2014-12-23 00:05 - 00002759 _____ () C:\Users\Isetta\Desktop\FSS.txt
2014-12-22 23:58 - 2014-12-22 23:58 - 00002634 _____ () C:\Users\Isetta\Desktop\Winmgmt.reg
2014-12-22 23:54 - 2014-12-23 00:01 - 00000112 _____ () C:\Windows\setupact.log
2014-12-22 23:54 - 2014-12-22 23:54 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-22 22:41 - 2014-12-22 22:41 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-12-22 22:41 - 2014-12-22 22:41 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-12-22 22:30 - 2014-12-22 22:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-12-22 21:15 - 2014-12-22 21:15 - 00002639 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Neues Microsoft Office-Dokument.lnk
2014-12-22 21:15 - 2014-12-22 21:15 - 00002639 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Microsoft Office-Dokument öffnen.lnk
2014-12-22 21:15 - 2014-12-22 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-12-22 21:11 - 2014-12-22 21:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-12-22 21:09 - 2014-12-22 21:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-12-22 21:08 - 2014-12-22 21:08 - 00000000 ____D () C:\Windows\PCHEALTH
2014-12-22 21:06 - 2014-12-22 21:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2005
2014-12-22 21:06 - 2014-12-22 21:06 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-12-22 21:05 - 2014-12-22 21:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-12-22 21:05 - 2014-12-22 21:05 - 00000000 ____D () C:\IDE
2014-12-22 21:04 - 2014-12-22 22:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-12-22 21:04 - 2014-12-22 21:09 - 00000000 ____D () C:\Windows\SHELLNEW
2014-12-22 21:04 - 2014-12-22 21:04 - 00000000 __RHD () C:\MSOCache
2014-12-22 00:48 - 2014-12-22 00:48 - 00415232 _____ (Farbar) C:\Users\Isetta\Desktop\FSS.exe
2014-12-22 00:36 - 2014-12-22 00:36 - 00001224 _____ () C:\Users\Isetta\Desktop\Revo Uninstaller.lnk
2014-12-22 00:36 - 2014-12-22 00:36 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-12-21 22:22 - 2014-12-23 05:47 - 00000000 ____D () C:\FRST
2014-12-21 22:19 - 2014-12-21 22:19 - 00380416 _____ () C:\Users\Isetta\Desktop\Gmer-19357.exe
2014-12-21 22:18 - 2014-12-21 22:18 - 02122240 _____ (Farbar) C:\Users\Isetta\Desktop\FRST64.exe
2014-12-21 21:44 - 2014-12-22 01:25 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-21 21:43 - 2014-12-21 21:43 - 00001062 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-21 21:43 - 2014-12-21 21:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-21 21:43 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-21 21:43 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-21 21:43 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-21 21:42 - 2014-12-21 21:42 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Isetta\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-21 20:46 - 2014-12-21 20:46 - 01184256 _____ () C:\Users\Isetta\Downloads\MicrosoftFixit50450.msi
2014-12-21 17:29 - 2014-12-21 17:29 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-12-21 17:29 - 2014-12-21 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-21 17:28 - 2014-12-21 17:29 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-21 15:38 - 2014-12-21 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-21 15:36 - 2014-12-21 15:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-21 14:43 - 2014-12-21 14:43 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\QuickScan
2014-12-21 14:06 - 2014-12-21 14:06 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-12-21 14:05 - 2014-12-21 14:05 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-12-21 14:05 - 2014-12-21 14:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-12-21 14:04 - 2014-12-21 14:04 - 14107296 _____ (Microsoft Corporation) C:\Users\Isetta\Downloads\mseinstall.exe
2014-12-21 13:13 - 2014-12-21 13:19 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-21 13:13 - 2014-11-27 16:40 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-21 12:50 - 2014-12-21 12:50 - 00002962 _____ () C:\Windows\System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769}
2014-12-18 22:06 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-18 22:06 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-12 19:41 - 2014-12-12 19:41 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-12 19:23 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-12 19:23 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-10 19:30 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 19:30 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 19:30 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 19:30 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 19:29 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 19:29 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 19:29 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 19:29 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 19:29 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 19:29 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 19:29 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 19:29 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 19:29 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 19:29 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 19:29 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 19:29 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 19:29 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 19:29 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 19:29 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 19:29 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 19:29 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 19:29 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 19:29 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 19:29 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 19:29 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 19:29 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 19:29 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 19:29 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 19:29 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 19:29 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 19:29 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 19:29 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 19:29 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 19:29 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 19:29 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 19:29 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 19:29 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 19:29 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 19:29 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 19:29 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 19:29 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 19:29 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 19:29 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 19:29 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 19:29 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 19:29 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 19:29 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 19:29 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 19:29 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 19:29 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 19:29 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 19:29 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 19:29 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 19:29 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 19:29 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 19:29 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 19:29 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 19:28 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 19:28 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 19:28 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 19:28 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 19:28 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 19:28 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 19:26 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 19:26 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-10 19:26 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 19:26 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-10 19:26 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 19:26 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 19:26 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 19:26 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-10 19:26 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-10 19:26 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-07 22:31 - 2014-12-07 22:31 - 00000000 ____D () C:\Users\Isetta\AppData\Local\{33D6233C-631C-4C78-9150-12CBDACBEE1F}
2014-12-07 12:49 - 2014-12-07 20:41 - 00075982 _____ () C:\Users\Isetta\Documents\Fotobuch.pbf
2014-12-07 12:49 - 2014-12-07 20:40 - 00000000 ____D () C:\Users\Isetta\Documents\Fotobuch-Dateien
2014-12-07 12:21 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-12-07 12:17 - 2014-12-07 12:17 - 00001025 _____ () C:\Users\Public\Desktop\posterXXL Designer.lnk
2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\Users\Isetta\AppData\Local\posterXXL Designer
2014-12-07 12:17 - 2014-12-07 12:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\posterXXL Designer
2014-12-07 12:16 - 2014-12-07 12:17 - 00000000 ____D () C:\Program Files (x86)\posterXXL Designer
2014-12-07 12:16 - 2014-12-07 12:16 - 00000000 ____D () C:\ProgramData\posterXXL Designer

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-23 05:14 - 2013-09-05 20:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-23 04:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-23 04:19 - 2011-09-15 00:40 - 01203609 _____ () C:\Windows\WindowsUpdate.log
2014-12-23 03:10 - 2014-06-24 08:05 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job
2014-12-23 01:56 - 2014-01-03 19:13 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\Skype
2014-12-23 00:08 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-23 00:08 - 2009-07-14 05:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-23 00:06 - 2011-07-19 19:45 - 00735450 _____ () C:\Windows\system32\perfh007.dat
2014-12-23 00:06 - 2011-07-19 19:45 - 00165278 _____ () C:\Windows\system32\perfc007.dat
2014-12-23 00:06 - 2009-07-14 06:13 - 01716326 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-23 00:01 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-22 23:21 - 2014-05-06 21:30 - 00000000 ____D () C:\Windows\Minidump
2014-12-22 23:21 - 2012-05-03 16:30 - 00000000 ____D () C:\Users\Isetta\AppData\Local\CrashDumps
2014-12-22 23:00 - 2012-02-20 20:41 - 00109296 _____ () C:\Users\Isetta\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-22 22:58 - 2009-07-14 05:45 - 00411240 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-22 22:56 - 2012-07-09 19:12 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-22 22:32 - 2012-02-20 20:37 - 00000000 ____D () C:\Users\Isetta
2014-12-22 22:13 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-12-22 21:28 - 2014-06-12 16:03 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForIsetta
2014-12-22 21:28 - 2014-06-12 16:03 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForIsetta.job
2014-12-22 21:10 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-12-22 21:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-12-22 20:35 - 2012-02-20 20:42 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{16B80042-919F-4825-962C-0F560E7139F1}
2014-12-21 23:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-21 20:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-21 17:32 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther
2014-12-21 16:33 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-12-21 13:46 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-21 13:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-21 13:10 - 2014-07-09 16:26 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-12-21 13:10 - 2011-07-19 10:37 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-12-21 12:50 - 2012-02-22 16:19 - 00000000 ____D () C:\Users\Isetta\AppData\Roaming\TP
2014-12-12 19:41 - 2014-05-06 21:29 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-12 19:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-12 19:18 - 2014-06-24 08:05 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job
2014-12-10 19:14 - 2013-09-05 20:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-10 19:14 - 2013-09-05 20:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-10 19:14 - 2011-07-19 10:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-03 19:34 - 2014-09-23 17:38 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-03 19:34 - 2014-01-03 19:12 - 00000000 ____D () C:\ProgramData\Skype

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-23 04:28

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---


Addition:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2014 01
Ran by Isetta at 2014-12-23 05:49:15
Running from C:\Users\Isetta\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD System Monitor (HKLM-x32\...\{4144F415-7434-4501-97DE-CED4FAF64E7D}) (Version: 1.0.6 - Advanced Micro Devices, Inc.)
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Druckerdeinstallation für EPSON SX235 Series (HKLM\...\EPSON SX235 Series) (Version:  - SEIKO EPSON Corporation)
Epson Easy Photo Print 2 (HKLM-x32\...\{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}) (Version: 2.2.4.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}) (Version: 2.50.0000 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.22 - Evernote Corp.)
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{DE15C5EC-7C30-44BF-ACEB-03960FC5601D}) (Version: 1.1.1.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{D7670221-BF9B-4DFF-B26B-5BE55A87329F}) (Version: 1.2.2 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{ABEF00D0-FCAE-4E47-8D4E-D4AE5FD72B15}) (Version: 2.4.3 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{999164B6-5B78-4DD3-BACE-7292640AD0DD}) (Version: 3.1.0.9760 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{B446137B-18A1-4FAE-B0E4-ABE8F09705F1}) (Version: 4.1.6.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}) (Version: 6.0.5.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6319.0 - IDT)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
mobilt bredband (HKLM-x32\...\{9941ABED-87FF-413B-9E89-15F60487AEC7}_x) (Version: 2.3.1.343 - Option)
mobilt bredband (Version: 2.3.1.343 - Option) Hidden
MyDriveConnect 3.3.0.1756 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1756 - TomTom)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
posterXXL Designer 5.3 (HKLM-x32\...\posterXXL Designer_is1) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.34.1130.2010 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.74 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0323 - REALTEK Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

21-12-2014 16:52:42 Sicherung
21-12-2014 16:57:50 Installed Microsoft Office Professional Plus 2010
21-12-2014 17:05:27 Installed Microsoft Office Professional Plus 2010
21-12-2014 20:21:26 Installed Microsoft Office Professional Plus 2010
22-12-2014 00:36:45 Revo Uninstaller's restore point - Ask Toolbar
22-12-2014 20:45:54 Installed Microsoft Office Professional Plus 2010
22-12-2014 21:04:03 Installed Microsoft Office Enterprise 2007
22-12-2014 22:06:50 Windows Update
22-12-2014 22:41:00 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01CD728C-0F0D-4E77-8871-8E07F46FBB3B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10] (Adobe Systems Incorporated)
Task: {14460768-4127-4C46-ABA3-C2AAAC36FB53} - System32\Tasks\{E4E2C0C1-7F02-4EB0-9FFD-5B3642EA89F7} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {228C7504-7D29-415A-A71B-5A0D6A5FC04F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {2B9C4A26-BBB6-45F6-A11A-1EDD900CDB5D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {489C1D1F-6EA1-4A09-A3E2-BDC30D41B667} - System32\Tasks\{78E3B084-AA86-43D7-9CFD-2467B45BD769} => G:\SetupConsumerC2ROLW\SetupConsumerC2ROLW.exe
Task: {4EE2C4F6-5D77-4F67-B4D3-FBD06E37B7C3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {6DF4B400-48FF-431F-A192-8D1EE0DB404B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {8A365B95-91ED-4035-A7C8-9B2795609C85} - System32\Tasks\HPCeeScheduleForIsetta => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {AB27DFA1-5A10-41A8-8673-573EB0171489} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {ADB5E7E7-C4DF-4374-868C-A6F274E111FA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {B820529A-CD60-46CA-AD0F-87CE2661FABC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {B86FF47E-9F0A-424E-9D38-642FE509FE25} - System32\Tasks\{77929317-B71E-4FFD-9A41-601176702D51} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/go/help.faq.installer?LastError=1603
Task: {BD219128-8028-4F82-84B5-6146C13F5CDE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {CE621FE8-1944-4885-B142-C306BE95C44C} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ATTENTION
Task: {E75235D9-85F8-49D7-8647-26FA431E6B8A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-06-24] (Facebook Inc.)
Task: {F5CF6616-96EB-4E46-93AE-17CC12EE51E9} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001Core.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2848928747-3939298252-169735021-1001UA.job => C:\Users\Isetta\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForIsetta.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2011-07-05 10:27 - 2011-07-05 10:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-27 15:18 - 2011-06-27 15:18 - 00107320 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2011-07-05 10:27 - 2011-07-05 10:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 10:13 - 2011-07-05 10:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 12:42 - 2011-06-17 12:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00026488 _____ () C:\Program Files (x86)\MyDrive Connect\DeviceDetection.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00087416 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterBase.dll
2014-08-22 09:38 - 2014-08-22 09:38 - 00398712 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterProxy.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2848928747-3939298252-169735021-500 - Administrator - Disabled)
Gast (S-1-5-21-2848928747-3939298252-169735021-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2848928747-3939298252-169735021-1003 - Limited - Enabled)
Isetta (S-1-5-21-2848928747-3939298252-169735021-1001 - Administrator - Enabled) => C:\Users\Isetta

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/23/2014 04:33:55 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (12/23/2014 04:33:51 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/23/2014 00:21:01 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/23/2014 00:15:49 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/23/2014 00:15:31 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/23/2014 00:15:31 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/23/2014 00:15:21 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/23/2014 00:15:08 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/23/2014 00:02:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/22/2014 11:56:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: HPWMISVC.exe, Version: 2.3.1.0, Zeitstempel: 0x4d9e7ce7
Name des fehlerhaften Moduls: HPWMISVC.exe, Version: 2.3.1.0, Zeitstempel: 0x4d9e7ce7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000016d1
ID des fehlerhaften Prozesses: 0x164
Startzeit der fehlerhaften Anwendung: 0xHPWMISVC.exe0
Pfad der fehlerhaften Anwendung: HPWMISVC.exe1
Pfad des fehlerhaften Moduls: HPWMISVC.exe2
Berichtskennung: HPWMISVC.exe3


System errors:
=============
Error: (12/23/2014 00:00:30 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (12/22/2014 11:57:24 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/22/2014 11:56:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HPWMISVC" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/22/2014 11:54:34 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/22/2014 11:50:14 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (12/22/2014 11:23:05 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/22/2014 11:18:53 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/22/2014 11:01:44 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "Sicherheitscenter" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.

Error: (12/22/2014 11:00:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HPWMISVC" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/22/2014 10:59:06 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist von folgendem Dienst abhängig: winmgmt. Dieser Dienst ist eventuell nicht installiert.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: AMD A4-3300M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 35%
Total physical RAM: 5610.91 MB
Available physical RAM: 3629.25 MB
Total Pagefile: 11219.99 MB
Available Pagefile: 9122.03 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:445.89 GB) (Free:386.8 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.71 GB) (Free:1.71 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.1 GB) FAT32
Drive f: (16 Aug 2012) (CDROM) (Total:0.69 GB) (Free:0.65 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1ECE8725)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=445.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)

==================== End Of Log ============================
         
MfG Scout

Alt 26.12.2014, 00:21   #10
Bootsektor
Ruhe in Frieden
† 2019
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo,

sehr schön.

Ein paar Toolbarbrösel in ESET, ein bißchen Ask weiter nichts.

Deinstalliere bitte noch

Java 7 Update 65

und alle Passwörter ändern!

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {5AE9D7B8-B472-43C8-88FA-E8AF099800E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=2741FEC2-7D0B-4058-AFB7-0012EF268CAA&apn_sauid=D607FE12-53EA-44D6-B737-012D030B7E91
Task: {CE621FE8-1944-4885-B142-C306BE95C44C} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Program Files (x86)\Ask.com
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll
C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\009DE561.exe
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



OK
So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber.
Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir.

Schritt 1

Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren.
Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen.

Schritt 2
Downloade dir bitte delfix auf deinen Desktop.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.
  • DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.
Falls nach Delfix noch Programme aus unserer Bereinigung vorhanden sein sollten, kannst du diese nun bedenkenlos löschen.

Updates / Programme aktualisieren
  • Adobe Reader
Dein Adobe Reader ist veraltet.
Deinstalliere Deinen Reader und lade Dir die neueste Version von hier herunter. Schaue, ob sich noch etwas mit installieren möchte und entferne den Haken gegebenenfalls.
  • FlashPlayer
Deine FlashPlayer für Firefox und den Internet Explorer sind nicht mehr aktuell.
  • Deinstalliere die alten Versionen.
  • Öffne nacheinander mit beiden Browsern folgenden Link Adobe - Adobe Flash Player installieren und lade Dir von dort die neueste Version herunter.
  • Falls sich dort etwas anderes als der FlashPlayer noch zusätzlich mitinstallieren möchte, entferne den Haken dort.
Aktualisierung einstellen
Stelle sicher, dass dein FlashPlayer nach Updates sucht. Den FlashPlayer kann man direkt bei der Installation so konfigurieren, dass er nach Updates automatisch sucht, nachträglich kann man das über folgenden Link machen:
Adobe - Flash Player: Einstellungsmanager - Globale Benachrichtigungseinstellungen

Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems.

Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
  • verwende für jede Anwendung und jeden Account ein anderes Passwort
  • ändere regelmäßig dein Passwort, vor allem bei Onlinebanking oder deinem Emailpostfach ist dieses sehr wichtig
  • speichere keine Passwörter auf deinem PC, gib diese nicht an dritte weiter
  • ein sicheres Passwort besteht aus mindestens 8 Zeichen und beinhaltet Groß- und Kleinbuchstaben, Zahlen, und Sonderzeichen
  • benutze keine Zahlen- oder Buchstabenkombinationen, ( zB 12345678, qwertzui) auch keine Zahlen oder Buchstabenmuster
  • verwende keine Passwörter die einen Bezug zu dir, deinem Wohnort, Familienmitglied oder Haustier (Geburtsdatum, Postleitzahl, Adresse, Name) haben


Aktualität des Systems
Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java, sofern vorhanden) aktuell sind.
  • Bitte überprüfe, ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.

  • Java
Java ist eine große Sicherheitslücke auf deinem System, es werden immer wieder neue Schwachstellen entdeckt, die ausgenutzt werden um Rechner zu infizieren.
Sofern du Java nicht zwingend benötigst, solltest du es komplett deinstallieren.

Windows XP
Gehe auf:
Start --> Systemsteuerung --> Software --> Javaversionen auswählen --> entfernen
Windows Vista
Gehe auf:
Start --> Systemsteuerung -- > Programme --> Programme deinstallieren --> Javaversionen suchen --> entfernen
Windows 7
Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Programm auswählen --> entfernen
Windows 8
Dazu drücke auf:
Windowstaste und X
dann:
Programme und Funktionen -->Javaversionen auswählen --> entfernen

Falls du Java doch unbedingt benötigst, dann sorge dafür, dass Java automatisch updated.
Dazu:
  • öffne Java
  • klicke auf den Reiter Update
  • klicke auf: Benachrichtung ausgeben: Vor dem Download setze den Haken bei Automatisch nach Updates suchen
  • klicke auf Erweitert
  • ändere das Intervall mindestens auf wöchentlich
und schalte das Browser-Plugin aus.
Hier findest du eine Anleitung dazu.

Antivirensoftware
  • Gehe sicher immer eine Antiviren Software installiert zu haben und halte diese unbedingt aktuell.

Zusätzlicher Schutz
  • MalwareBytes Anti-Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On-Demand Scantool welches viele aktuelle Malware erkennt und auch entfernt.
    Aktualisiere das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf einen Banner um diesen zu AdBlockPlus hinzuzufügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.


Systemleistung
Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu die Datenträgerbereinigung von Windows.
Windows Vista
  • Klicke unten links auf das Vistasymbol
  • Gehe auf Programme -> Zubehör -> Systemprogramme -> Datenträgerbereinigung
  • Wähle nun Dateien von allen Benutzern des Computers aus und bestätige mit OK
  • Setze den Haken bei den zu löschenden Dateien zusätzlich bei Temporäre Dateien
  • Bestätige mit OK
  • Bestätige dass du die Dateien unwiderruflich löschen möchtest

Windows 7
  • Gehe auf das Windowsstartsymbol
  • Gebe im Suchfeld Datenträgerrereinigung ein
  • Setze den Haken zusätzlich bei Temporäre Dateien
  • Bestätige mit OK

Windows 8
  • Rechtsklicke in die untere linke Ecke deines Bildschirms
  • Klicke auf Suchen
  • Klicke auf Einstellungen
  • Gebe im Suchfeld Datenträgerbereinigung ein
  • Klicke in den Einstellungen auf der linken Seite nun auf Speicherplatz durch Löschen nicht erforderlicher Dateien freigeben
  • Setze den Haken zusätzlich bei Temporäre Dateien
  • Bestätige mit OK
  • Bestätige dass du die Dateien unwiderruflich löschen möchtest


Halte dich fern von jeglichen Registry Cleanern.
Diese schaden deinem System mehr als dass sie es schneller machen.

Verhaltensregeln zum sichereren Surfen
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
  • Achte besonders bei der Installation von Programmen darauf, ob sich weitere Software mitinstallieren möchte, wähle wo immer es geht die benutzerdefinierte Installation und wähle alles ab, was nichts mit dem Programm zu tun hat, welches du dir installieren möchtest.

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind.

Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun.

Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun.

Alt 26.12.2014, 01:06   #11
scout165
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo Sandra,

Das Java veraltet war hatte ich schon gesehen. Ich habe jetzt Java 8 Update 25 drauf.

Hier die Log von FRST:

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-12-2014 01
Ran by Isetta at 2014-12-26 00:56:45 Run:2
Running from C:\Users\Isetta\Desktop
Loaded Profile: Isetta (Available profiles: Isetta)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-2848928747-3939298252-169735021-1001 -> {5AE9D7B8-B472-43C8-88FA-E8AF099800E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=2741FEC2-7D0B-4058-AFB7-0012EF268CAA&apn_sauid=D607FE12-53EA-44D6-B737-012D030B7E91
Task: {CE621FE8-1944-4885-B142-C306BE95C44C} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Program Files (x86)\Ask.com
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll
C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll
C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\009DE561.exe

*****************

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}" => Key deleted successfully.
HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found. 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key could not be deleted. Error: -1073741772
"HKU\S-1-5-21-2848928747-3939298252-169735021-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}" => Key deleted successfully.
HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found. 
"HKU\S-1-5-21-2848928747-3939298252-169735021-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5AE9D7B8-B472-43C8-88FA-E8AF099800E0}" => Key deleted successfully.
HKCR\CLSID\{5AE9D7B8-B472-43C8-88FA-E8AF099800E0} => Key not found. 
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CE621FE8-1944-4885-B142-C306BE95C44C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CE621FE8-1944-4885-B142-C306BE95C44C}" => Key deleted successfully.
C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"C:\Program Files (x86)\Ask.com" => File/Directory not found.
"C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEIPlug.dll" => File/Directory not found.
"C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\4zEZSETP.dll" => File/Directory not found.
"C:\Program Files (x86)\VideoDownloadConverter_4zEI\Installr\1.bin\NP4zEISb.dll" => File/Directory not found.
"C:\Users\Isetta\AppData\LocalLow\VideoDownloadConverter_4zEI\Installr\Cache\009DE561.exe" => File/Directory not found.
         
Der Rest ist in Arbeit.....

MfG scout

Alt 26.12.2014, 01:36   #12
Bootsektor
Ruhe in Frieden
† 2019
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Schau nochmal, ob Java 7 auch komplett deinstalliert ist.

Alt 26.12.2014, 02:53   #13
scout165
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Hallo Sandra,

hatte ich über Systemsteuerung > Programme und Funktionen deinstalliert. Ist in der Liste der Programme auch nicht mehr aufgeführt.

MfG scout

Ich habe nun auch die anderen Punkte abgearbeitet. System ist bereinigt, Programme und Plugins sind aktualisiert. Du hast mir sehr geholfen, ich danke dir für deine kompetente Hilfe.
Ich habe zum Abschluß noch mal mit Anti Malware gescannt - Alles Sauber.
Deine Tipps gebe ich an meine Bekannte weiter.
Eine Frage zum Schluß.
Was war denn nun die Ursache für das Problem?
Ich wünsche Dir noch schöne Weihnachten (was davon übrig ist).
Ihr leistet hier tolle Arbeit, macht weiter so!

MfG scout

Alt 26.12.2014, 21:54   #14
Bootsektor
Ruhe in Frieden
† 2019
 
Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Standard

Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz



Es waren Reste einer Infektion auf diesem Rechner, die unter anderen Passwörter sammelt, außerdem hatte diese einen Windowsservice "befallen", deswegen startete das MS AV nicht mehr.

Antwort

Themen zu Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz
administrator, adobe flash player, ask toolbar entfernen, ask toolbar updater entfernen, askbar, bingbar, branding, device driver, dringend, explorer, fehlercode 0x80070490, fehlercode windows, flash player, ip-hilfsdienst, microsoft, microsoft fix it, neustart, pup.optional.advancedsystemprotector, pup.optional.frostwiretb.a, pup.optional.mindspark.a, pup.optional.regcleanerpro.a, registry, security, software, winlogon.exe



Ähnliche Themen: Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz


  1. Windows7 taskmgr lässt sich nicht starten, Avira Echtzeitscanner lässt sich nicht aktivieren, USB wird nicht angenommen, ohne Meldung,
    Log-Analyse und Auswertung - 01.06.2015 (15)
  2. (Vista) Sicherheitscenter lässt sich nicht mehr aktivieren
    Log-Analyse und Auswertung - 24.12.2014 (3)
  3. Avira antivir guard lässt sich nicht aktivieren, Sicherheitscenter: Firewall, Virenschutz und automatische Updates inaktiv
    Log-Analyse und Auswertung - 21.10.2014 (34)
  4. Sicherheitscenter lässt sich nicht mehr aktivieren
    Log-Analyse und Auswertung - 12.07.2014 (7)
  5. Google Redirect & Windows Sicherheitscenter lässt sich nicht aktivieren
    Log-Analyse und Auswertung - 31.07.2013 (20)
  6. AdWare und Windows Sicherheitscenter lässt sich nicht aktivieren
    Plagegeister aller Art und deren Bekämpfung - 23.06.2013 (21)
  7. Umleitung von Google-Suchergebnissen, Windows-Sicherheitscenter lässt sich nicht aktivieren
    Plagegeister aller Art und deren Bekämpfung - 18.02.2013 (23)
  8. Windows-Sicherheitscenter lässt sich nicht aktivieren/Fehlweiterleitungen bei Google
    Plagegeister aller Art und deren Bekämpfung - 28.01.2013 (22)
  9. WIN Sicherheitscenter aka Firewall lässt sich nicht aktivieren
    Log-Analyse und Auswertung - 16.08.2012 (3)
  10. (Vista) Sicherheitscenter lässt sich nach Virus nicht mehr aktivieren
    Log-Analyse und Auswertung - 11.04.2012 (9)
  11. google redirect , windows-sicherheitscenter lässt sich nicht aktivieren
    Log-Analyse und Auswertung - 05.01.2012 (2)
  12. Windows-Sicherheitscenter lässt sich nicht aktivieren
    Antiviren-, Firewall- und andere Schutzprogramme - 27.03.2011 (5)
  13. Windows-Sicherheitscenter lässt sich nicht aktivieren
    Mülltonne - 26.03.2011 (1)
  14. Windows Sicherheitscenter lässt sich nicht mehr aktivieren, die zweite
    Plagegeister aller Art und deren Bekämpfung - 08.03.2011 (2)
  15. Windows-Sicherheitscenter lässt sich nicht mehr aktivieren
    Plagegeister aller Art und deren Bekämpfung - 02.03.2011 (15)
  16. Sicherheitscenter lässt sich nicht aktivieren/deaktiviert sich sofort wieder
    Plagegeister aller Art und deren Bekämpfung - 27.01.2011 (26)

Zum Thema Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz - Hallo, Ihr Spezialisten! ich habe von einer Bekannten einen Laptop zur Behebung eines Problems "in Behandlung". Eigentlich bemängelte sie nur, das sich keine Word/Excel-Dateien mehr öffnen lassen. Mir ist aber - Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz...
Archiv
Du betrachtest: Sicherheitscenter lässt sich nicht aktivieren - Laptop wohl länger ohne Virenschutz auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.