Chrome öffnet automatisch neue Tabs

amigo54 · 24.01.2015, 15:21

Hallo,

wie der Betreff schon sagt, öffnet Chrome automatisch neue (leere) Tabs. Nach vorübergehender De-Installation von Chrome geschah das Gleiche beim Internet-Explorer.

Im Rahmen meiner Suche (u.a. mit JRT, MBAM, adwcleander ) bin ich auf IMinent gestoßen und hab es so gut es ging, vom Rechner geschmissen. In einem der Logfiles habe ich aber immer noch einen Hinweis darauf gefunden, den ich nicht loswerde:

CHR HomePage: Default -> hxxp://start.iminent.com/?appId=3E8BB516-CB92-48AD-A6C2-12C7A9C906B4

Auch wird über einen PANDA-Eintrag (der Virenscanner war mal auf dem Rechner installiert) gemeckert, den ich nicht am angegeben Ort finde.

Noch vorhandene Logfiles füge ich bei und geben euch hoffentlich mehr Auskunft als mir

Schon mal vielen Dank!
Beste Grüße

Defogger

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:04 on 24/01/2015 (Gregor)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

GMER

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-24 14:33:00
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002a Samsung_SSD_840_EVO_120GB rev.EXT0BB0Q 111,79GB
Running: 52n0jlfl.exe; Driver: C:\Users\Gregor\AppData\Local\Temp\kwtdapob.sys


---- User code sections - GMER 2.1 ----

.text    C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                             00007ffd6ea9169a 4 bytes [A9, 6E, FD, 7F]
.text    C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                             00007ffd6ea916a2 4 bytes [A9, 6E, FD, 7F]
.text    C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                                00007ffd6ea9181a 4 bytes [A9, 6E, FD, 7F]
.text    C:\WINDOWS\System32\spoolsv.exe[1564] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                                00007ffd6ea91832 4 bytes [A9, 6E, FD, 7F]
.text    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506               00007ffd6ea9169a 4 bytes [A9, 6E, FD, 7F]
.text    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514               00007ffd6ea916a2 4 bytes [A9, 6E, FD, 7F]
.text    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118                  00007ffd6ea9181a 4 bytes [A9, 6E, FD, 7F]
.text    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2488] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142                  00007ffd6ea91832 4 bytes [A9, 6E, FD, 7F]
.text    C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe[2620] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                      00007ffd64411f6a 4 bytes [41, 64, FD, 7F]
.text    C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe[2620] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                      00007ffd64411f82 4 bytes [41, 64, FD, 7F]
.text    C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                            00007ffd6ea9169a 4 bytes [A9, 6E, FD, 7F]
.text    C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                            00007ffd6ea916a2 4 bytes [A9, 6E, FD, 7F]
.text    C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                               00007ffd6ea9181a 4 bytes [A9, 6E, FD, 7F]
.text    C:\Windows\System32\igfxpers.exe[5104] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                               00007ffd6ea91832 4 bytes [A9, 6E, FD, 7F]

---- Threads - GMER 2.1 ----

Thread   C:\WINDOWS\system32\csrss.exe [912:936]                                                                                                  fffff960008ceb90
Thread   C:\WINDOWS\explorer.exe [532:5724]                                                                                                       00007ffd5ca8d73c

---- Services - GMER 2.1 ----

Service  C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe (*** hidden *** )                                                   [AUTO] panda_url_filtering                                                                                                                                                                                                                                                                                                                     <-- ROOTKIT !!!
Service  C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys (*** hidden *** )                                                   [MANUAL] panda_url_filteringd                                                                                                                                                                                                                                                                                                                  <-- ROOTKIT !!!

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime                                                                        0x76 0xC4 0x87 0xB4 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime                                                                           0x76 0xC4 0x87 0xB4 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime                                                                       0xAC 0xC5 0x55 0x63 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime                                                                    0xAC 0xC5 0x55 0x63 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@de-DE                                                                    71
Reg      HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\GSM566F184880_09_07D8_B1^638A8C2BB76C28D854675B699B927F6F@Timestamp  0x8A 0xFF 0xD1 0xB4 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid                                                                                         1016
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations                                                        \??\C:\ProgramData\DataMngr\stats.cfg??\??\C:\WINDOWS\RAVTC.TMP??\??\C:\WINDOWS\RAVDG.TMP??\??\C:\SMCLpav\PAVSMCL.dll??\??\C:\SMCLpav\SMCLPav.dll??\??\C:\SMCLpav\SMCLpav.exe??\??\C:\SMCLpav\DGNano.dll??\??\C:\Program Files (x86)\Panda Security\??\??\C:\SMCLpav??\??\C:\SMCLpav\??\??\C:\Users\Gregor\AppData\Local\Temp\_iu14D2N.tmp??
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber                                                       4521651
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                        -957593797
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId                                        74
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime                                      433394455
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime                                                                     5869
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime                                                                   5247
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID                                                                         c3bd114e-e40e-4bea-8bec-100d087
Reg      HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog@FileCounter                                                             2
Reg      HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger@FileCounter                                                               4
Reg      HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter                                                           2
Reg      HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Control\Print\Printers\Canon iP4700 series@PrinterOnLine   1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\AVGIDSHA\Parameters@Reboot                                                                        75
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Avgmfx64\Parameters@Params                                                                        33795
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering                                                                               
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@Type                                                                          16
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@Start                                                                         2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@ErrorControl                                                                  1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@ImagePath                                                                     C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe --
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@DisplayName                                                                   panda_url_filtering Service
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@ObjectName                                                                    LocalSystem
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering@Description                                                                   Provides Anti-Phishing protection
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filtering                                                                               
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd                                                                              
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@Type                                                                         1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@Start                                                                        3
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@ErrorControl                                                                 0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@ImagePath                                                                    \??\C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@DisplayName                                                                  panda_url_filteringd driver
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd@Tag                                                                          95
Reg      HKLM\SYSTEM\CurrentControlSet\Services\panda_url_filteringd                                                                              
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                          6428
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                         3262
Reg      HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence                                                                   73
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop                                                         0
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw                                                                                       0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask                                                                                   0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw                                                                                       0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask                                                                                   0x64 0x62 0x03 0x00 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer@GlobalAssocChangedCounter                                                        292
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced@Hidden                                                                  2
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log                                                                  
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log@0                                                                0x73 0x00 0x6F 0x00 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log@MRUListEx                                                        0x00 0x00 0x00 0x00 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown                                                           1
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@PolicyDocumentLastRefresh                                         0xE8 0x1A 0x64 0xC4 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@WindowsBandwidthBucketCounter                                     47112
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@WindowsRequestBucketCounter                                       119
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsRequestBucketDrainTime                                 0x0E 0x69 0x72 0xC4 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsLargeRequestBucketDrainTime                            0x0E 0x69 0x72 0xC4 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@OtherBandwidthBucketCounter                                       282
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@OtherRequestBucketCounter                                         198
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastOtherRequestBucketDrainTime                                   0x0E 0x69 0x72 0xC4 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@GlobalBandwidthBucketCounter                                      125811
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@GlobalRequestBucketCounter                                        298
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastGlobalRequestBucketDrainTime                                  0x0E 0x69 0x72 0xC4 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastUploadTime                                                    0x70 0xCB 0x74 0xC4 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@RoamingSyncToken                                                  LM%3d63557695680310%3bID%3dE4875D739E502A9A!106%3bLR%3d63557685929257%3bEP%3d4%3bTD%3dTrue
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest                                   0xF4 0xBA 0x49 0xEA ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce@Report                                                                            C:\AdwCleaner\AdwCleaner[S3].txt

---- EOF - GMER 2.1 ----

FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Gregor (administrator) on USER-PC on 24-01-2015 14:33:11
Running from C:\Users\Gregor\Downloads
Loaded Profiles: Gregor (Available profiles: Gregor & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8_64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(VMLite, Inc.) C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Canon Electronics Inc.) C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [CANON DR-P215 SVC] => rundll32.exe PHCSVC.DLL,EntryPointUserMessage
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133408 2012-09-11] (Intel Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [P-215 CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe [966656 2012-07-19] (Canon Electronics Inc.)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => D:\Software\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [Reminder] => C:\Program Files (x86)\Microsoft Money\System\reminder.exe [37376 1999-03-15] (Microsoft Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef3d-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef5a-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
ShortcutTarget: Adobe Gamma Loader.exe.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Gregor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_280.dll ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_280.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> D:\Software\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> F:\FoxitReader\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files (x86)\Sibelius Software\Scorch\npsibelius.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://start.iminent.com/?appId=3E8BB516-CB92-48AD-A6C2-12C7A9C906B4
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-13]
CHR Extension: (Google-Suche) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-13]
CHR Extension: (Google Wallet) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-13]
CHR Extension: (Evernote Web Clipper) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2014-08-24]
CHR Extension: (Google Mail) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 Emc.Captiva.WebCaptureService; C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe [39936 2012-04-04] (EMC Corporation) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Start8; C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe [143288 2014-06-18] (Stardock Software, Inc)
R2 VMLiteService; C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe [426600 2010-08-21] (VMLite, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 asahci64; C:\Windows\System32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-24] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R1 VBoxDrv; C:\Windows\System32\drivers\VBoxDrv.sys [204328 2010-08-11] (VMLite, Inc.)
R3 VBoxNetAdp; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [146216 2010-08-11] (VMLite, Inc.)
R3 VBoxNetFlt; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [165800 2010-08-11] (VMLite, Inc.)
R1 vmlitedrv; C:\Windows\System32\drivers\vmlitedrv.sys [14952 2010-08-03] (VMLite, Inc.)
R3 vmlitestor; C:\Windows\system32\DRIVERS\vmlitestor.sys [177768 2010-08-11] (VMLite, Inc.)
R1 VMLiteUSBMon; C:\Windows\System32\drivers\vmliteusbmon.sys [135272 2010-08-18] (VMLite, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
U3 kwtdapob; \??\C:\Users\Gregor\AppData\Local\Temp\kwtdapob.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-24 14:33 - 2015-01-24 14:33 - 00016964 _____ () C:\Users\Gregor\Downloads\FRST.txt
2015-01-24 14:33 - 2015-01-24 14:33 - 00015571 _____ () C:\Users\Gregor\Desktop\Gmer.txt
2015-01-24 13:44 - 2015-01-24 13:44 - 03494400 _____ () C:\Users\Gregor\Documents\QC_150124134449.bak
2015-01-24 13:08 - 2015-01-24 13:08 - 00380416 _____ () C:\Users\Gregor\Downloads\52n0jlfl.exe
2015-01-24 13:01 - 2015-01-24 13:01 - 00000000 ____D () C:\Users\Gregor\Downloads\FRST-OlderVersion
2015-01-24 13:00 - 2015-01-24 13:00 - 00000000 _____ () C:\Users\Gregor\defogger_reenable
2015-01-24 09:21 - 2015-01-24 09:21 - 00050477 _____ () C:\Users\Gregor\Downloads\Defogger.exe
2015-01-24 08:49 - 2015-01-24 08:54 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Nico Mak Computing
2015-01-24 08:49 - 2015-01-24 08:49 - 04917720 _____ (WinZip International LLC ) C:\Users\Gregor\Downloads\wzmp_8.exe
2015-01-24 08:48 - 2015-01-24 08:49 - 58043240 _____ () C:\Users\Gregor\Downloads\FREEAV1504.exe
2015-01-24 08:44 - 2015-01-24 12:22 - 11801792 ____R () C:\Users\Gregor\Money Backup 24.01.2015.mbf
2015-01-24 00:44 - 2015-01-24 00:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (2).exe
2015-01-24 00:44 - 2015-01-24 00:44 - 00001290 _____ () C:\Users\Gregor\Desktop\Revo Uninstaller.lnk
2015-01-23 23:40 - 2015-01-23 23:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-23 23:39 - 2015-01-24 13:55 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-23 23:39 - 2015-01-24 13:44 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-23 23:39 - 2015-01-23 23:39 - 00004098 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-23 23:39 - 2015-01-23 23:39 - 00003862 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-23 23:15 - 2015-01-23 23:15 - 04188536 _____ (Piriform Ltd) C:\Users\Gregor\Downloads\ccsetup501_slim.exe
2015-01-23 23:15 - 2015-01-23 23:15 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-01-23 23:15 - 2015-01-23 23:15 - 00000840 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-23 23:14 - 2015-01-24 00:44 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95.exe
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (1).exe
2015-01-23 23:11 - 2015-01-24 14:33 - 00000000 ____D () C:\FRST
2015-01-23 23:11 - 2015-01-24 13:01 - 02129920 _____ (Farbar) C:\Users\Gregor\Downloads\FRST64.exe
2015-01-23 22:53 - 2015-01-24 13:55 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-23 22:52 - 2015-01-23 22:52 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Gregor\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-21 23:02 - 2015-01-21 23:21 - 00000213 _____ () C:\prefs.js
2015-01-21 23:02 - 2015-01-21 23:21 - 00000000 ____D () C:\searchplugins
2015-01-21 23:02 - 2015-01-21 23:02 - 00004648 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpService.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\LavasoftStatistics
2015-01-21 23:02 - 2014-12-16 12:10 - 00358736 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2015-01-21 23:02 - 2014-12-16 12:10 - 00312424 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll
2015-01-21 22:59 - 2015-01-21 23:21 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-01-21 22:59 - 2015-01-21 22:59 - 01937320 _____ () C:\Users\Gregor\Downloads\AdAware115WebInstaller.exe
2015-01-20 20:18 - 2015-01-24 14:22 - 00000000 ____D () C:\AdwCleaner
2015-01-20 20:17 - 2015-01-20 20:17 - 02186752 _____ () C:\Users\Gregor\Downloads\adwcleaner_4.108.exe
2015-01-20 20:01 - 2015-01-20 20:01 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-20 20:00 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Downloads\JRT.exe
2015-01-20 18:25 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-01-20 18:25 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\ProgramData\ZDSupport
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\Program Files (x86)\Hostless Modem
2015-01-13 22:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:30 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:30 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-08 18:55 - 2015-01-08 18:55 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Avg
2015-01-02 18:45 - 2015-01-02 18:45 - 00000791 _____ () C:\Users\Gregor\Desktop\Soulful.lnk
2014-12-25 00:19 - 2014-12-25 00:19 - 00000000 __SHD () C:\Users\Gregor\AppData\Local\EmieBrowserModeList
2014-12-25 00:15 - 2014-12-25 00:43 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\CDTPL
2014-12-25 00:15 - 2014-12-25 00:15 - 00000000 ____D () C:\ProgramData\CDTPL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-24 14:20 - 2013-12-11 14:47 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4223944866-4218211989-4134806692-1001
2015-01-24 14:15 - 2013-12-16 21:24 - 02610176 ___SH () C:\Users\Gregor\Desktop\Thumbs.db
2015-01-24 14:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-24 13:59 - 2013-11-14 08:26 - 01789004 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-24 13:59 - 2013-11-14 08:11 - 00768888 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-24 13:59 - 2013-11-14 08:11 - 00160706 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-24 13:55 - 2013-12-14 11:08 - 00000000 __RDO () C:\Users\Gregor\SkyDrive
2015-01-24 13:55 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-24 13:47 - 2014-11-29 12:18 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Deployment
2015-01-24 13:45 - 2014-11-29 12:20 - 06291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2015-01-24 13:45 - 2014-11-29 12:20 - 01572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2015-01-24 13:45 - 2013-12-11 15:05 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-24 13:44 - 2014-11-29 14:10 - 00022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2015-01-24 13:44 - 2014-11-29 12:19 - 00002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2015-01-24 13:38 - 2013-12-14 10:58 - 00000000 ____D () C:\Users\Gregor
2015-01-24 13:38 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-24 12:57 - 2014-08-27 18:20 - 00000174 _____ () C:\WINDOWS\setscan.ini
2015-01-24 12:22 - 2013-12-14 23:26 - 11798528 _____ () C:\Users\Gregor\Documents\Finanzen.mny
2015-01-24 12:09 - 2013-12-26 10:13 - 00000000 ____D () C:\Program Files (x86)\Chord Pro Manager
2015-01-24 11:15 - 2013-12-11 15:06 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-24 09:45 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-24 09:00 - 2013-12-14 11:19 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{27D26F56-1E79-48C6-844C-D4E9DBC2810B}
2015-01-24 08:59 - 2013-12-14 11:42 - 00151032 _____ () C:\Users\Gregor\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-24 08:57 - 2013-08-22 15:44 - 00610976 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-24 01:12 - 2013-12-14 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-01-24 01:12 - 2013-12-14 11:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Samsung
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-01-24 00:48 - 2013-12-11 14:57 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-24 00:27 - 2014-11-30 09:23 - 11801792 ____R () C:\Users\Gregor\Money Backup 30.11.2014.mbf
2015-01-24 00:14 - 2014-08-24 17:59 - 00000000 ____D () C:\Users\Gregor\Desktop\Evernote Sync
2015-01-24 00:00 - 2013-12-12 12:20 - 00000000 ____D () C:\ProgramData\Advanced
2015-01-23 23:40 - 2013-12-13 22:17 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-23 23:17 - 2014-04-02 17:07 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\AIMP3
2015-01-23 23:17 - 2013-12-14 10:56 - 00000000 ___DC () C:\WINDOWS\Panther
2015-01-23 23:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Resources
2015-01-23 23:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Performance
2015-01-21 23:11 - 2013-12-11 16:09 - 01807894 _____ () C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2015-01-21 22:48 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-21 22:20 - 2014-08-24 15:41 - 00000000 ____D () C:\Program Files (x86)\Evernote
2015-01-21 19:18 - 2014-08-24 16:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Skitch
2015-01-20 23:15 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-20 21:30 - 2014-01-04 20:18 - 00000000 ____D () C:\temp
2015-01-20 19:57 - 2013-12-11 15:12 - 00000000 ____D () C:\Users\Gregor\VMLites
2015-01-20 18:24 - 2013-12-11 15:46 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-20 18:23 - 2013-12-11 15:46 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-19 22:32 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-19 22:32 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 22:45 - 2013-12-11 15:05 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-01-10 23:18 - 2014-02-28 14:27 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\vlc
2015-01-08 18:56 - 2014-03-31 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-02 18:43 - 2013-12-17 22:06 - 00175104 ___SH () C:\Users\Gregor\Downloads\Thumbs.db

==================== Files in the root of some directories =======

2014-05-02 18:11 - 2014-06-15 13:23 - 0560516 _____ () C:\Users\Gregor\AppData\Roaming\Scorch_Install.log
2013-12-27 15:14 - 2013-12-28 11:30 - 0001323 _____ () C:\Users\Gregor\AppData\Roaming\songpress.ini
2014-11-29 14:10 - 2015-01-24 13:44 - 0022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2014-11-29 12:19 - 2015-01-24 13:44 - 0002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2014-11-29 12:20 - 2015-01-24 13:45 - 6291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2014-11-29 12:20 - 2015-01-24 13:45 - 1572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2013-12-14 10:57 - 2013-12-14 10:57 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-21 20:02

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Gregor at 2015-01-24 14:33:31
Running from C:\Users\Gregor\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus 2014 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2014 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.280 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1345, 26.03.2014 - AIMP DevTeam)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4257 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon driver for P-215 (x64) (HKLM\...\{CB884F7A-3B20-43EF-9B46-0663A28EDF1A}) (Version: 1.2.4706 - Canon Electronics Inc.)
Canon iP4700 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series) (Version:  - )
CaptureOnTouch Evernote Plugin (HKLM-x32\...\{CE27CA2B-7663-4F6B-8E61-A455390AC71F}) (Version: 1.2.11005 - Canon Electronics Inc.)
CaptureOnTouch Google Docs(TM) Plugin (HKLM-x32\...\{31DAEBE6-4FF6-487F-8AB9-3BEFB9B863D1}) (Version: 1.3.4625 - Canon Electronics Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chord Pro Manager (HKLM-x32\...\ST6UNST #1) (Version:  - )
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\CopyTrans Suite) (Version: 3.003 - WindSolutions)
DDBAC (HKLM-x32\...\{4C19650D-1BF8-4459-A904-06FB692B0F8E}) (Version: 5.3.24 - DataDesign)
DDBAC (HKLM-x32\...\{88A0F52F-A024-4268-977E-E75B1F9C67ED}) (Version: 5.3.28 - DataDesign)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version:  - Steinberg Media Technologies GmbH)
Evernote v. 5.7.2 (HKLM-x32\...\{FB57263E-706F-11E4-A65F-00163E98E7D6}) (Version: 5.7.2.5753 - Evernote Corp.)
Finale Allegro 2005 (HKLM-x32\...\Finale Allegro 2005) (Version:  - )
Garmin Communicator Plugin (HKLM-x32\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin x64 (HKLM\...\{70A381F1-C161-4D61-A20C-BE12FC6777DF}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM-x32\...\{7D542452-84EB-47C0-97BA-735C523AB555}) (Version: 3.6.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HBCI-Modul für Money 99 Version 2000 (HKLM-x32\...\{8A13EBF6-6249-4C0D-92BE-F8497C922311}_is1) (Version: 5.0.1.10 - Dr. Ulrich Amann)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Money 99 (HKLM-x32\...\MSMONEYV70) (Version:  - )
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Communicator 2007 (HKLM-x32\...\{0FCA0973-24C0-48EA-8CF6-71B53C135C09}) (Version: 2.0.6362.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Money-Browser für Money 99 Version 2000 3.0.1.37 (HKLM-x32\...\{E9E9FCFC-9F1A-4EDC-8400-2EAB5A9DEB4F}_is1) (Version: 3.0.1.37 - Dr. Ulrich Amann)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)
P-215 CaptureOnTouch (HKLM-x32\...\{551DCCF1-A5D6-4090-86A5-38EA6EB5AC18}) (Version: 2.3.212.727 - Canon Electronics Inc.)
P-215 UserManual (HKLM-x32\...\{B00EDF44-C4C7-4857-872D-4C8459AD589B}) (Version: 1.05.0000 - Canon Electronics Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PaperPort SharePoint Link (HKLM-x32\...\{8D09F3C8-C890-4118-B3CC-697BE7FA0421}) (Version: 12.000.0001 - Nuance Communications, Inc.)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM-x32\...\{EA820D43-3E3F-4B16-BAA2-DCAB0D4E7F1A}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Setup-Loader für das HBCI-Modul für Money 99 Version 2000 3.4 (HKLM-x32\...\Setup-Loader für das HBCI-Modul für Money 99 Version 2000_is1) (Version: 3.4 - Dr. Ulrich Amann)
Sibelius Scorch (Firefox, Opera, Netscape, Chrome only) (HKLM-x32\...\{41626CC0-A854-4402-AD06-D7939515C282}) (Version: 6.2.0 - Sibelius Software, a division of Avid Technology, Inc.)
SportTracks 3.1 (HKLM-x32\...\{99895EF0-B290-4B21-B1FE-FB00E1B5D195}) (Version: 3.1.5349 - Zone Five Software)
Stardock Start8 (HKLM-x32\...\Stardock Start8) (Version: 1.45 - Stardock Software, Inc.)
Steinberg Upload Manager (HKLM-x32\...\{88BBBD8F-4C19-4809-B84B-7A8F8238B48D}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
Transcribe! 8.40 (HKLM-x32\...\Transcribe!_is1) (Version: 8.40 - Seventh String Software)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VMLite Workstation (HKLM\...\{197F2BEF-2705-406E-8CEB-8E404FFFE414}) (Version: 3.2.6 - VMLite)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{4F9EFA88-960A-41FA-B56C-FE993D861FA6}) (Version: 21.00.8480 - Buhl Data Service GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

12-01-2015 18:14:07 Geplanter Prüfpunkt
15-01-2015 18:25:52 Windows Update
18-01-2015 23:48:34 Windows Update
21-01-2015 22:22:28 Removed Google Earth.
24-01-2015 00:00:04 Removed Shark007 Advanced Codecs.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {021E431F-94F7-4185-9C82-8EFBA4DA5C1B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {161E825F-E2AA-4175-BC1F-4D03F9100354} - System32\Tasks\{ABD1FC5D-F115-4312-B835-5F72B0F06AF4} => pcalua.exe -a "C:\Users\Gregor\Downloads\4200fvst648620a_64de (1).exe" -d C:\Users\Gregor\Downloads
Task: {1A375487-EF08-4A15-8F70-1A4A42A70C3C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {25A85C4D-8964-40AF-8CEA-D0460D6289D0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {74650E97-E9EB-4BB7-9433-4ED6150CAFBD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {7A45A7A8-4288-490C-8299-A7F713F83303} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {8313ECDA-A864-4051-999F-CAF2FFE9D945} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {8B87EC0D-B85A-44B1-92CD-A450FAF8E1C2} - System32\Tasks\{719118DA-0CB0-4201-9147-FC0A6DF78DC1} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64en.exe -d C:\Users\Gregor\Downloads
Task: {ABA0824B-9509-4D54-8A2A-9ED32C299005} - System32\Tasks\{85AB14EB-242A-4810-BD1C-583A453A67DE} => pcalua.exe -a C:\Users\Gregor\Downloads\USBDrivers_231.exe -d C:\Users\Gregor\Downloads
Task: {B0EA0542-A73D-4B8E-A82B-BC7270F21CB5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-20] (Microsoft Corporation)
Task: {B1DF5B7B-A9B2-4C1B-884A-5EEC2C435BDA} - System32\Tasks\{A9C356FA-DEB4-4F61-9E59-27C969DEC297} => pcalua.exe -a E:\Scangear\German\SetupSG.exe -d E:\Scangear\German
Task: {C306D80E-A5E0-4838-B3B3-556019779A6A} - System32\Tasks\{090D3749-44DF-4ED3-80AB-291B6A2A604E} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64de\SetupSG.exe -d C:\Users\Gregor\Downloads\4200fvst648620a_64de
Task: {F73BD0F3-8AE0-4712-A9B3-3AF2DB03D345} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-10 17:45 - 2006-06-27 16:28 - 00322048 _____ () C:\WINDOWS\system32\CNQL3203.DLL
2010-08-11 14:18 - 2010-08-11 14:18 - 00202344 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxDDU.dll
2010-08-11 14:18 - 2010-08-11 14:18 - 02725480 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxRT.dll
2009-03-26 22:03 - 2009-03-26 22:03 - 01289728 _____ () C:\Program Files\VMLite\VMLite Workstation\LIBEAY32.dll
2013-10-07 14:52 - 2013-10-07 14:52 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-22 08:19 - 2013-08-22 07:54 - 00174592 _____ () C:\WINDOWS\system32\WinMetadata\Windows.UI.winmd
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-04-04 18:54 - 2012-04-04 18:54 - 00015360 _____ () C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\SSLSupport.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00438336 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00320064 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2015-01-24 10:26 - 2015-01-24 10:26 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\c89a3da49bf7bd161745f4228277ea00\PSIClient.ni.dll
2013-12-11 15:01 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\All Users:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Application Data:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\Gregor\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "WISO Mein Steuer-Sparbuch heute.lnk"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKLM\...\StartupApproved\Run32: => "OpwareSE2"
HKLM\...\StartupApproved\Run32: => "OPSE reminder"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesPreload"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesAirMessage"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "Reminder"

========================= Accounts: ==========================

Administrator (S-1-5-21-4223944866-4218211989-4134806692-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-4223944866-4218211989-4134806692-501 - Limited - Disabled)
Gregor (S-1-5-21-4223944866-4218211989-4134806692-1001 - Administrator - Enabled) => C:\Users\Gregor
HomeGroupUser$ (S-1-5-21-4223944866-4218211989-4134806692-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Netzwerkcontroller
Description: Netzwerkcontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (01/24/2015 02:29:44 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:29:14 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:27:22 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:26:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:26:21 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:25:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:25:21 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:24:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:24:21 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (01/24/2015 02:23:51 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office Sessions:
=========================
Error: (12/31/2014 06:26:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 565 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (08/30/2014 01:19:56 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 0 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3245 CPU @ 3.40GHz
Percentage of memory in use: 26%
Total physical RAM: 7873.64 MB
Available physical RAM: 5774.63 MB
Total Pagefile: 9089.64 MB
Available Pagefile: 7183.09 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (SYSTEM) (Fixed) (Total:111.45 GB) (Free:63.49 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:465.76 GB) (Free:465.11 GB) NTFS
Drive f: (Festplatte) (Fixed) (Total:698.64 GB) (Free:565.58 GB) NTFS
Drive g: (TREKSTOR) (Fixed) (Total:298.09 GB) (Free:109.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 7CA3E6EF)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: BF66C29B)
Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 7CA3E6FA)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 298.1 GB) (Disk ID: 066667C0)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 24.01.2015, 15:25

hi,

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

amigo54 · 24.01.2015, 16:43

Hi,

erst einmal vielen Dank für die schnelle Antwort.

Die genannten Programme habe ich nochmals laufen lassen.

Grüße

MBAM

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 24.01.2015
Suchlauf-Zeit: 16:08:31
Logdatei: BAMB.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.24.08
Rootkit Datenbank: v2015.01.14.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Gregor

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 431003
Verstrichene Zeit: 4 Min, 29 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

ADWCLEANER

Code:

ATTFilter

# AdwCleaner v4.109 - Bericht erstellt am 24/01/2015 um 16:20:25
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-24.4 [Live]
# Betriebssystem : Windows 8.1 Pro  (64 bits)
# Benutzername : Gregor - USER-PC
# Gestartet von : C:\Users\Gregor\Downloads\adwcleaner_4.109.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Google Chrome v40.0.2214.91


*************************

AdwCleaner[R0].txt - [3177 octets] - [20/01/2015 20:18:04]
AdwCleaner[R1].txt - [1078 octets] - [21/01/2015 22:23:34]
AdwCleaner[R2].txt - [2792 octets] - [23/01/2015 23:46:06]
AdwCleaner[R3].txt - [1117 octets] - [24/01/2015 01:01:45]
AdwCleaner[R4].txt - [1445 octets] - [24/01/2015 13:53:39]
AdwCleaner[R5].txt - [1298 octets] - [24/01/2015 14:21:30]
AdwCleaner[R6].txt - [1467 octets] - [24/01/2015 16:16:50]
AdwCleaner[S0].txt - [3132 octets] - [20/01/2015 21:23:54]
AdwCleaner[S1].txt - [1141 octets] - [21/01/2015 22:36:47]
AdwCleaner[S2].txt - [2853 octets] - [23/01/2015 23:50:59]
AdwCleaner[S3].txt - [1506 octets] - [24/01/2015 13:55:01]
AdwCleaner[S4].txt - [1388 octets] - [24/01/2015 16:20:25]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1448 octets] ##########

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 8.1 Pro x64
Ran by Gregor on 24.01.2015 at 16:28:02,39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.01.2015 at 16:31:14,81
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Gregor (administrator) on USER-PC on 24-01-2015 16:33:11
Running from C:\Users\Gregor\Downloads
Loaded Profiles: Gregor (Available profiles: Gregor & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8_64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(VMLite, Inc.) C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Canon Electronics Inc.) C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [CANON DR-P215 SVC] => rundll32.exe PHCSVC.DLL,EntryPointUserMessage
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133408 2012-09-11] (Intel Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [P-215 CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe [966656 2012-07-19] (Canon Electronics Inc.)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => D:\Software\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [Reminder] => C:\Program Files (x86)\Microsoft Money\System\reminder.exe [37376 1999-03-15] (Microsoft Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef3d-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef5a-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
ShortcutTarget: Adobe Gamma Loader.exe.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Gregor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_280.dll ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_280.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> D:\Software\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> F:\FoxitReader\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files (x86)\Sibelius Software\Scorch\npsibelius.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://start.iminent.com/?appId=3E8BB516-CB92-48AD-A6C2-12C7A9C906B4
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-13]
CHR Extension: (Google-Suche) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-13]
CHR Extension: (Google Wallet) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-13]
CHR Extension: (Evernote Web Clipper) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2014-08-24]
CHR Extension: (Google Mail) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 Emc.Captiva.WebCaptureService; C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe [39936 2012-04-04] (EMC Corporation) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Start8; C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe [143288 2014-06-18] (Stardock Software, Inc)
R2 VMLiteService; C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe [426600 2010-08-21] (VMLite, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 asahci64; C:\Windows\System32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-24] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R1 VBoxDrv; C:\Windows\System32\drivers\VBoxDrv.sys [204328 2010-08-11] (VMLite, Inc.)
R3 VBoxNetAdp; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [146216 2010-08-11] (VMLite, Inc.)
R3 VBoxNetFlt; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [165800 2010-08-11] (VMLite, Inc.)
R1 vmlitedrv; C:\Windows\System32\drivers\vmlitedrv.sys [14952 2010-08-03] (VMLite, Inc.)
R3 vmlitestor; C:\Windows\system32\DRIVERS\vmlitestor.sys [177768 2010-08-11] (VMLite, Inc.)
R1 VMLiteUSBMon; C:\Windows\System32\drivers\vmliteusbmon.sys [135272 2010-08-18] (VMLite, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-24 16:31 - 2015-01-24 16:31 - 00000619 _____ () C:\Users\Gregor\Desktop\JRT.txt
2015-01-24 16:26 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Desktop\JRT.exe
2015-01-24 16:21 - 2015-01-24 16:21 - 00001528 _____ () C:\Users\Gregor\Desktop\AdwCleaner[S4].txt
2015-01-24 16:20 - 2015-01-24 16:20 - 00000314 _____ () C:\WINDOWS\PFRO.log
2015-01-24 16:20 - 2015-01-24 16:20 - 00000077 _____ () C:\WINDOWS\setupact.log
2015-01-24 16:20 - 2015-01-24 16:20 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-01-24 16:16 - 2015-01-24 16:16 - 02194432 _____ () C:\Users\Gregor\Downloads\adwcleaner_4.109.exe
2015-01-24 16:13 - 2015-01-24 16:13 - 00001190 _____ () C:\Users\Gregor\Desktop\Mbam.txt
2015-01-24 15:04 - 2015-01-24 15:04 - 00000474 _____ () C:\Users\Gregor\Downloads\defogger_disable.log
2015-01-24 14:33 - 2015-01-24 16:33 - 00017226 _____ () C:\Users\Gregor\Downloads\FRST.txt
2015-01-24 14:33 - 2015-01-24 16:32 - 00144360 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-24 13:44 - 2015-01-24 13:44 - 03494400 _____ () C:\Users\Gregor\Documents\QC_150124134449.bak
2015-01-24 13:08 - 2015-01-24 13:08 - 00380416 _____ () C:\Users\Gregor\Downloads\52n0jlfl.exe
2015-01-24 13:01 - 2015-01-24 13:01 - 00000000 ____D () C:\Users\Gregor\Downloads\FRST-OlderVersion
2015-01-24 13:00 - 2015-01-24 13:00 - 00000000 _____ () C:\Users\Gregor\defogger_reenable
2015-01-24 09:21 - 2015-01-24 09:21 - 00050477 _____ () C:\Users\Gregor\Downloads\Defogger.exe
2015-01-24 08:49 - 2015-01-24 08:54 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Nico Mak Computing
2015-01-24 08:49 - 2015-01-24 08:49 - 04917720 _____ (WinZip International LLC ) C:\Users\Gregor\Downloads\wzmp_8.exe
2015-01-24 08:48 - 2015-01-24 08:49 - 58043240 _____ () C:\Users\Gregor\Downloads\FREEAV1504.exe
2015-01-24 08:44 - 2015-01-24 12:22 - 11801792 ____R () C:\Users\Gregor\Money Backup 24.01.2015.mbf
2015-01-24 00:44 - 2015-01-24 00:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (2).exe
2015-01-24 00:44 - 2015-01-24 00:44 - 00001290 _____ () C:\Users\Gregor\Desktop\Revo Uninstaller.lnk
2015-01-23 23:40 - 2015-01-23 23:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-23 23:39 - 2015-01-24 16:21 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-23 23:39 - 2015-01-24 15:44 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-23 23:39 - 2015-01-23 23:39 - 00004098 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-23 23:39 - 2015-01-23 23:39 - 00003862 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-23 23:15 - 2015-01-23 23:15 - 04188536 _____ (Piriform Ltd) C:\Users\Gregor\Downloads\ccsetup501_slim.exe
2015-01-23 23:15 - 2015-01-23 23:15 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-01-23 23:15 - 2015-01-23 23:15 - 00000840 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-23 23:14 - 2015-01-24 00:44 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95.exe
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (1).exe
2015-01-23 23:11 - 2015-01-24 16:33 - 00000000 ____D () C:\FRST
2015-01-23 23:11 - 2015-01-24 13:01 - 02129920 _____ (Farbar) C:\Users\Gregor\Downloads\FRST64.exe
2015-01-23 22:53 - 2015-01-24 16:21 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-23 22:52 - 2015-01-23 22:52 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Gregor\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-21 23:02 - 2015-01-21 23:21 - 00000213 _____ () C:\prefs.js
2015-01-21 23:02 - 2015-01-21 23:21 - 00000000 ____D () C:\searchplugins
2015-01-21 23:02 - 2015-01-21 23:02 - 00004648 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpService.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\LavasoftStatistics
2015-01-21 23:02 - 2014-12-16 12:10 - 00358736 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2015-01-21 23:02 - 2014-12-16 12:10 - 00312424 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll
2015-01-21 22:59 - 2015-01-21 23:21 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-01-21 22:59 - 2015-01-21 22:59 - 01937320 _____ () C:\Users\Gregor\Downloads\AdAware115WebInstaller.exe
2015-01-20 20:18 - 2015-01-24 16:23 - 00000000 ____D () C:\AdwCleaner
2015-01-20 20:01 - 2015-01-20 20:01 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-20 20:00 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Downloads\JRT.exe
2015-01-20 18:25 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-01-20 18:25 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\ProgramData\ZDSupport
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\Program Files (x86)\Hostless Modem
2015-01-13 22:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:30 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:30 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-08 18:55 - 2015-01-08 18:55 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Avg
2015-01-02 18:45 - 2015-01-02 18:45 - 00000791 _____ () C:\Users\Gregor\Desktop\Soulful.lnk
2014-12-25 00:19 - 2014-12-25 00:19 - 00000000 __SHD () C:\Users\Gregor\AppData\Local\EmieBrowserModeList
2014-12-25 00:15 - 2014-12-25 00:43 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\CDTPL
2014-12-25 00:15 - 2014-12-25 00:15 - 00000000 ____D () C:\ProgramData\CDTPL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-24 16:26 - 2013-12-11 14:47 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4223944866-4218211989-4134806692-1001
2015-01-24 16:25 - 2013-11-14 08:26 - 01789004 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-24 16:25 - 2013-11-14 08:11 - 00768888 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-24 16:25 - 2013-11-14 08:11 - 00160706 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-24 16:21 - 2013-12-14 11:08 - 00000000 ___DO () C:\Users\Gregor\SkyDrive
2015-01-24 16:20 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-24 16:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-24 15:45 - 2013-12-11 15:05 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-24 15:19 - 2013-12-14 11:19 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{27D26F56-1E79-48C6-844C-D4E9DBC2810B}
2015-01-24 15:15 - 2013-12-11 15:06 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-24 14:15 - 2013-12-16 21:24 - 02610176 ___SH () C:\Users\Gregor\Desktop\Thumbs.db
2015-01-24 13:47 - 2014-11-29 12:18 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Deployment
2015-01-24 13:45 - 2014-11-29 12:20 - 06291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2015-01-24 13:45 - 2014-11-29 12:20 - 01572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2015-01-24 13:44 - 2014-11-29 14:10 - 00022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2015-01-24 13:44 - 2014-11-29 12:19 - 00002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2015-01-24 13:38 - 2013-12-14 10:58 - 00000000 ____D () C:\Users\Gregor
2015-01-24 13:38 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-24 12:57 - 2014-08-27 18:20 - 00000174 _____ () C:\WINDOWS\setscan.ini
2015-01-24 12:22 - 2013-12-14 23:26 - 11798528 _____ () C:\Users\Gregor\Documents\Finanzen.mny
2015-01-24 12:09 - 2013-12-26 10:13 - 00000000 ____D () C:\Program Files (x86)\Chord Pro Manager
2015-01-24 09:45 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-24 08:59 - 2013-12-14 11:42 - 00151032 _____ () C:\Users\Gregor\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-24 08:57 - 2013-08-22 15:44 - 00610976 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-24 01:12 - 2013-12-14 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-01-24 01:12 - 2013-12-14 11:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Samsung
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-01-24 00:48 - 2013-12-11 14:57 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-24 00:27 - 2014-11-30 09:23 - 11801792 ____R () C:\Users\Gregor\Money Backup 30.11.2014.mbf
2015-01-24 00:14 - 2014-08-24 17:59 - 00000000 ____D () C:\Users\Gregor\Desktop\Evernote Sync
2015-01-24 00:00 - 2013-12-12 12:20 - 00000000 ____D () C:\ProgramData\Advanced
2015-01-23 23:40 - 2013-12-13 22:17 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-23 23:17 - 2014-04-02 17:07 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\AIMP3
2015-01-23 23:17 - 2013-12-14 10:56 - 00000000 ___DC () C:\WINDOWS\Panther
2015-01-23 23:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Resources
2015-01-23 23:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Performance
2015-01-21 23:11 - 2013-12-11 16:09 - 01807894 _____ () C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2015-01-21 22:48 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-21 22:20 - 2014-08-24 15:41 - 00000000 ____D () C:\Program Files (x86)\Evernote
2015-01-21 19:18 - 2014-08-24 16:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Skitch
2015-01-20 23:15 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-20 21:30 - 2014-01-04 20:18 - 00000000 ____D () C:\temp
2015-01-20 19:57 - 2013-12-11 15:12 - 00000000 ____D () C:\Users\Gregor\VMLites
2015-01-20 18:24 - 2013-12-11 15:46 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-20 18:23 - 2013-12-11 15:46 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-19 22:32 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-19 22:32 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 22:45 - 2013-12-11 15:05 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-01-10 23:18 - 2014-02-28 14:27 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\vlc
2015-01-08 18:56 - 2014-03-31 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-02 18:43 - 2013-12-17 22:06 - 00175104 ___SH () C:\Users\Gregor\Downloads\Thumbs.db

==================== Files in the root of some directories =======

2014-05-02 18:11 - 2014-06-15 13:23 - 0560516 _____ () C:\Users\Gregor\AppData\Roaming\Scorch_Install.log
2013-12-27 15:14 - 2013-12-28 11:30 - 0001323 _____ () C:\Users\Gregor\AppData\Roaming\songpress.ini
2014-11-29 14:10 - 2015-01-24 13:44 - 0022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2014-11-29 12:19 - 2015-01-24 13:44 - 0002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2014-11-29 12:20 - 2015-01-24 13:45 - 6291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2014-11-29 12:20 - 2015-01-24 13:45 - 1572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2013-12-14 10:57 - 2013-12-14 10:57 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-21 20:02

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Gregor at 2015-01-24 16:33:32
Running from C:\Users\Gregor\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.280 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1345, 26.03.2014 - AIMP DevTeam)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4257 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon driver for P-215 (x64) (HKLM\...\{CB884F7A-3B20-43EF-9B46-0663A28EDF1A}) (Version: 1.2.4706 - Canon Electronics Inc.)
Canon iP4700 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series) (Version:  - )
CaptureOnTouch Evernote Plugin (HKLM-x32\...\{CE27CA2B-7663-4F6B-8E61-A455390AC71F}) (Version: 1.2.11005 - Canon Electronics Inc.)
CaptureOnTouch Google Docs(TM) Plugin (HKLM-x32\...\{31DAEBE6-4FF6-487F-8AB9-3BEFB9B863D1}) (Version: 1.3.4625 - Canon Electronics Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chord Pro Manager (HKLM-x32\...\ST6UNST #1) (Version:  - )
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\CopyTrans Suite) (Version: 3.003 - WindSolutions)
DDBAC (HKLM-x32\...\{4C19650D-1BF8-4459-A904-06FB692B0F8E}) (Version: 5.3.24 - DataDesign)
DDBAC (HKLM-x32\...\{88A0F52F-A024-4268-977E-E75B1F9C67ED}) (Version: 5.3.28 - DataDesign)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version:  - Steinberg Media Technologies GmbH)
Evernote v. 5.7.2 (HKLM-x32\...\{FB57263E-706F-11E4-A65F-00163E98E7D6}) (Version: 5.7.2.5753 - Evernote Corp.)
Finale Allegro 2005 (HKLM-x32\...\Finale Allegro 2005) (Version:  - )
Garmin Communicator Plugin (HKLM-x32\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin x64 (HKLM\...\{70A381F1-C161-4D61-A20C-BE12FC6777DF}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM-x32\...\{7D542452-84EB-47C0-97BA-735C523AB555}) (Version: 3.6.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HBCI-Modul für Money 99 Version 2000 (HKLM-x32\...\{8A13EBF6-6249-4C0D-92BE-F8497C922311}_is1) (Version: 5.0.1.10 - Dr. Ulrich Amann)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Money 99 (HKLM-x32\...\MSMONEYV70) (Version:  - )
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Communicator 2007 (HKLM-x32\...\{0FCA0973-24C0-48EA-8CF6-71B53C135C09}) (Version: 2.0.6362.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Money-Browser für Money 99 Version 2000 3.0.1.37 (HKLM-x32\...\{E9E9FCFC-9F1A-4EDC-8400-2EAB5A9DEB4F}_is1) (Version: 3.0.1.37 - Dr. Ulrich Amann)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)
P-215 CaptureOnTouch (HKLM-x32\...\{551DCCF1-A5D6-4090-86A5-38EA6EB5AC18}) (Version: 2.3.212.727 - Canon Electronics Inc.)
P-215 UserManual (HKLM-x32\...\{B00EDF44-C4C7-4857-872D-4C8459AD589B}) (Version: 1.05.0000 - Canon Electronics Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PaperPort SharePoint Link (HKLM-x32\...\{8D09F3C8-C890-4118-B3CC-697BE7FA0421}) (Version: 12.000.0001 - Nuance Communications, Inc.)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM-x32\...\{EA820D43-3E3F-4B16-BAA2-DCAB0D4E7F1A}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Setup-Loader für das HBCI-Modul für Money 99 Version 2000 3.4 (HKLM-x32\...\Setup-Loader für das HBCI-Modul für Money 99 Version 2000_is1) (Version: 3.4 - Dr. Ulrich Amann)
Sibelius Scorch (Firefox, Opera, Netscape, Chrome only) (HKLM-x32\...\{41626CC0-A854-4402-AD06-D7939515C282}) (Version: 6.2.0 - Sibelius Software, a division of Avid Technology, Inc.)
SportTracks 3.1 (HKLM-x32\...\{99895EF0-B290-4B21-B1FE-FB00E1B5D195}) (Version: 3.1.5349 - Zone Five Software)
Stardock Start8 (HKLM-x32\...\Stardock Start8) (Version: 1.45 - Stardock Software, Inc.)
Steinberg Upload Manager (HKLM-x32\...\{88BBBD8F-4C19-4809-B84B-7A8F8238B48D}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
Transcribe! 8.40 (HKLM-x32\...\Transcribe!_is1) (Version: 8.40 - Seventh String Software)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VMLite Workstation (HKLM\...\{197F2BEF-2705-406E-8CEB-8E404FFFE414}) (Version: 3.2.6 - VMLite)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{4F9EFA88-960A-41FA-B56C-FE993D861FA6}) (Version: 21.00.8480 - Buhl Data Service GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

12-01-2015 18:14:07 Geplanter Prüfpunkt
15-01-2015 18:25:52 Windows Update
18-01-2015 23:48:34 Windows Update
21-01-2015 22:22:28 Removed Google Earth.
24-01-2015 00:00:04 Removed Shark007 Advanced Codecs.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {021E431F-94F7-4185-9C82-8EFBA4DA5C1B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {161E825F-E2AA-4175-BC1F-4D03F9100354} - System32\Tasks\{ABD1FC5D-F115-4312-B835-5F72B0F06AF4} => pcalua.exe -a "C:\Users\Gregor\Downloads\4200fvst648620a_64de (1).exe" -d C:\Users\Gregor\Downloads
Task: {1A375487-EF08-4A15-8F70-1A4A42A70C3C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {25A85C4D-8964-40AF-8CEA-D0460D6289D0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {74650E97-E9EB-4BB7-9433-4ED6150CAFBD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {7A45A7A8-4288-490C-8299-A7F713F83303} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {8313ECDA-A864-4051-999F-CAF2FFE9D945} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {8B87EC0D-B85A-44B1-92CD-A450FAF8E1C2} - System32\Tasks\{719118DA-0CB0-4201-9147-FC0A6DF78DC1} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64en.exe -d C:\Users\Gregor\Downloads
Task: {ABA0824B-9509-4D54-8A2A-9ED32C299005} - System32\Tasks\{85AB14EB-242A-4810-BD1C-583A453A67DE} => pcalua.exe -a C:\Users\Gregor\Downloads\USBDrivers_231.exe -d C:\Users\Gregor\Downloads
Task: {B1DF5B7B-A9B2-4C1B-884A-5EEC2C435BDA} - System32\Tasks\{A9C356FA-DEB4-4F61-9E59-27C969DEC297} => pcalua.exe -a E:\Scangear\German\SetupSG.exe -d E:\Scangear\German
Task: {C306D80E-A5E0-4838-B3B3-556019779A6A} - System32\Tasks\{090D3749-44DF-4ED3-80AB-291B6A2A604E} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64de\SetupSG.exe -d C:\Users\Gregor\Downloads\4200fvst648620a_64de
Task: {C347C46D-A479-47EF-AA22-87E6FBA5AB41} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-20] (Microsoft Corporation)
Task: {F73BD0F3-8AE0-4712-A9B3-3AF2DB03D345} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-10 17:45 - 2006-06-27 16:28 - 00322048 _____ () C:\WINDOWS\system32\CNQL3203.DLL
2010-08-11 14:18 - 2010-08-11 14:18 - 00202344 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxDDU.dll
2010-08-11 14:18 - 2010-08-11 14:18 - 02725480 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxRT.dll
2009-03-26 22:03 - 2009-03-26 22:03 - 01289728 _____ () C:\Program Files\VMLite\VMLite Workstation\LIBEAY32.dll
2013-10-07 14:52 - 2013-10-07 14:52 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-22 08:19 - 2013-08-22 07:54 - 00174592 _____ () C:\WINDOWS\system32\WinMetadata\Windows.UI.winmd
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-04-04 18:54 - 2012-04-04 18:54 - 00015360 _____ () C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\SSLSupport.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00438336 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00320064 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2015-01-24 10:26 - 2015-01-24 10:26 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\c89a3da49bf7bd161745f4228277ea00\PSIClient.ni.dll
2013-12-11 15:01 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-01-23 23:40 - 2015-01-21 04:50 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libglesv2.dll
2015-01-23 23:40 - 2015-01-21 04:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libegl.dll
2015-01-23 23:40 - 2015-01-21 04:50 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\All Users:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Application Data:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\Gregor\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "WISO Mein Steuer-Sparbuch heute.lnk"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKLM\...\StartupApproved\Run32: => "OpwareSE2"
HKLM\...\StartupApproved\Run32: => "OPSE reminder"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesPreload"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesAirMessage"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "Reminder"

========================= Accounts: ==========================

Administrator (S-1-5-21-4223944866-4218211989-4134806692-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-4223944866-4218211989-4134806692-501 - Limited - Disabled)
Gregor (S-1-5-21-4223944866-4218211989-4134806692-1001 - Administrator - Enabled) => C:\Users\Gregor
HomeGroupUser$ (S-1-5-21-4223944866-4218211989-4134806692-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Netzwerkcontroller
Description: Netzwerkcontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (01/24/2015 04:33:30 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office Sessions:
=========================
Error: (12/31/2014 06:26:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 565 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (08/30/2014 01:19:56 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 0 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3245 CPU @ 3.40GHz
Percentage of memory in use: 24%
Total physical RAM: 7873.64 MB
Available physical RAM: 5968 MB
Total Pagefile: 9089.64 MB
Available Pagefile: 7209.4 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (SYSTEM) (Fixed) (Total:111.45 GB) (Free:63.38 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:465.76 GB) (Free:465.11 GB) NTFS
Drive f: (Festplatte) (Fixed) (Total:698.64 GB) (Free:565.58 GB) NTFS
Drive g: (TREKSTOR) (Fixed) (Total:298.09 GB) (Free:109.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 7CA3E6EF)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: BF66C29B)
Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 7CA3E6FA)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 298.1 GB) (Disk ID: 066667C0)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 24.01.2015, 20:35

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

amigo54 · 25.01.2015, 21:56

Hallo,

habs nach Anleitung gemacht - aber leider immer noch das lästige Öffnen von Fenstern. ;-(

Eset hat zwei mögliche Bedrohungen gefunden. Bei FREEAV1504 handelt es sich um PANDA Antivirus. Und bei wzmp_8 um WINZIP Malware Protector.

Was mich bei der Anleitung zu Eset etwas überrascht hat, war der Umstand, dass der Button "Entdeckte Bedrohungen entfernen" nicht aktiviert war.
Die beiden eingesetzten Tools haben nach meinem Eindruck auch nichts am System verändert.

Viele Grüße

Hier sind die logs:

Eset

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=a0a596e97d258643bb8bff6df679db55
# engine=22139
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-25 08:23:02
# local_time=2015-01-25 09:23:02 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='AVG AntiVirus 2014'
# compatibility_mode=1050 16777213 100 100 7529 109351366 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 6182196 47098675 0 0
# scanned=221197
# found=2
# cleaned=0
# scan_time=1977
sh=614D9529C4AC5698BA44413ED9FF2F2AB7194030 ft=1 fh=fb5c7ba1cde5bf0c vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Gregor\Downloads\FREEAV1504.exe"
sh=B7A1757508588C3F277B97F877A74350068370AD ft=1 fh=49b56f64fa90416e vn="Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Gregor\Downloads\wzmp_8.exe"

CHECKUP.txt

Code:

ATTFilter

  Results of screen317's Security Check version 0.99.93  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
AVG AntiVirus 2014   
Windows Defender     
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Java 8 Update 25  
 Java version 32-bit out of Date! 
 Adobe Flash Player 	16.0.0.280  
 Adobe Reader XI  
 Mozilla Firefox (Firefox,. Firefox out of Date!  
 Google Chrome (40.0.2214.91) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 AVG avgwdsvc.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Gregor (administrator) on USER-PC on 25-01-2015 21:51:27
Running from C:\Users\Gregor\Downloads
Loaded Profiles: Gregor (Available profiles: Gregor & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(VMLite, Inc.) C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8_64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Canon Electronics Inc.) C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [CANON DR-P215 SVC] => rundll32.exe PHCSVC.DLL,EntryPointUserMessage
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133408 2012-09-11] (Intel Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [P-215 CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe [966656 2012-07-19] (Canon Electronics Inc.)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => D:\Software\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [Reminder] => C:\Program Files (x86)\Microsoft Money\System\reminder.exe [37376 1999-03-15] (Microsoft Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef3d-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef5a-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
ShortcutTarget: Adobe Gamma Loader.exe.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Gregor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_280.dll ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_280.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> D:\Software\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> F:\FoxitReader\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files (x86)\Sibelius Software\Scorch\npsibelius.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://start.iminent.com/?appId=3E8BB516-CB92-48AD-A6C2-12C7A9C906B4
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR Profile: C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-13]
CHR Extension: (Google-Suche) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-13]
CHR Extension: (Google Wallet) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-13]
CHR Extension: (Evernote Web Clipper) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2014-08-24]
CHR Extension: (Google Mail) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 Emc.Captiva.WebCaptureService; C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe [39936 2012-04-04] (EMC Corporation) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Start8; C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe [143288 2014-06-18] (Stardock Software, Inc)
R2 VMLiteService; C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe [426600 2010-08-21] (VMLite, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 asahci64; C:\Windows\System32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R1 VBoxDrv; C:\Windows\System32\drivers\VBoxDrv.sys [204328 2010-08-11] (VMLite, Inc.)
R3 VBoxNetAdp; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [146216 2010-08-11] (VMLite, Inc.)
R3 VBoxNetFlt; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [165800 2010-08-11] (VMLite, Inc.)
R1 vmlitedrv; C:\Windows\System32\drivers\vmlitedrv.sys [14952 2010-08-03] (VMLite, Inc.)
R3 vmlitestor; C:\Windows\system32\DRIVERS\vmlitestor.sys [177768 2010-08-11] (VMLite, Inc.)
R1 VMLiteUSBMon; C:\Windows\System32\drivers\vmliteusbmon.sys [135272 2010-08-18] (VMLite, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-25 21:34 - 2015-01-25 21:51 - 00000971 _____ () C:\Users\Gregor\Desktop\checkup.txt.txt
2015-01-25 21:33 - 2015-01-25 20:32 - 00852504 _____ () C:\Users\Gregor\Desktop\SecurityCheck.exe
2015-01-25 20:31 - 2015-01-25 20:32 - 00852504 _____ () C:\Users\Gregor\Downloads\SecurityCheck.exe
2015-01-25 20:31 - 2015-01-25 20:31 - 02347384 _____ (ESET) C:\Users\Gregor\Downloads\esetsmartinstaller_deu.exe
2015-01-24 16:26 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Desktop\JRT.exe
2015-01-24 16:20 - 2015-01-24 16:20 - 00000314 _____ () C:\WINDOWS\PFRO.log
2015-01-24 16:20 - 2015-01-24 16:20 - 00000077 _____ () C:\WINDOWS\setupact.log
2015-01-24 16:20 - 2015-01-24 16:20 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-01-24 16:16 - 2015-01-24 16:16 - 02194432 _____ () C:\Users\Gregor\Downloads\adwcleaner_4.109.exe
2015-01-24 15:04 - 2015-01-24 15:04 - 00000474 _____ () C:\Users\Gregor\Downloads\defogger_disable.log
2015-01-24 14:33 - 2015-01-25 21:51 - 00017548 _____ () C:\Users\Gregor\Downloads\FRST.txt
2015-01-24 14:33 - 2015-01-25 21:31 - 00215563 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-24 13:44 - 2015-01-24 13:44 - 03494400 _____ () C:\Users\Gregor\Documents\QC_150124134449.bak
2015-01-24 13:08 - 2015-01-24 13:08 - 00380416 _____ () C:\Users\Gregor\Downloads\52n0jlfl.exe
2015-01-24 13:01 - 2015-01-24 13:01 - 00000000 ____D () C:\Users\Gregor\Downloads\FRST-OlderVersion
2015-01-24 13:00 - 2015-01-24 13:00 - 00000000 _____ () C:\Users\Gregor\defogger_reenable
2015-01-24 09:21 - 2015-01-24 09:21 - 00050477 _____ () C:\Users\Gregor\Downloads\Defogger.exe
2015-01-24 08:49 - 2015-01-24 08:54 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Nico Mak Computing
2015-01-24 08:49 - 2015-01-24 08:49 - 04917720 _____ (WinZip International LLC ) C:\Users\Gregor\Downloads\wzmp_8.exe
2015-01-24 08:48 - 2015-01-24 08:49 - 58043240 _____ () C:\Users\Gregor\Downloads\FREEAV1504.exe
2015-01-24 08:44 - 2015-01-24 12:22 - 11801792 ____R () C:\Users\Gregor\Money Backup 24.01.2015.mbf
2015-01-24 00:44 - 2015-01-24 00:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (2).exe
2015-01-24 00:44 - 2015-01-24 00:44 - 00001290 _____ () C:\Users\Gregor\Desktop\Revo Uninstaller.lnk
2015-01-23 23:40 - 2015-01-23 23:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-23 23:39 - 2015-01-25 21:44 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-23 23:39 - 2015-01-25 20:18 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-23 23:39 - 2015-01-23 23:39 - 00004098 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-23 23:39 - 2015-01-23 23:39 - 00003862 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-23 23:15 - 2015-01-23 23:15 - 04188536 _____ (Piriform Ltd) C:\Users\Gregor\Downloads\ccsetup501_slim.exe
2015-01-23 23:15 - 2015-01-23 23:15 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-01-23 23:15 - 2015-01-23 23:15 - 00000840 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-23 23:14 - 2015-01-24 00:44 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95.exe
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (1).exe
2015-01-23 23:11 - 2015-01-25 21:51 - 00000000 ____D () C:\FRST
2015-01-23 23:11 - 2015-01-24 13:01 - 02129920 _____ (Farbar) C:\Users\Gregor\Downloads\FRST64.exe
2015-01-23 22:53 - 2015-01-25 21:07 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-23 22:52 - 2015-01-23 22:52 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Gregor\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-21 23:02 - 2015-01-21 23:21 - 00000213 _____ () C:\prefs.js
2015-01-21 23:02 - 2015-01-21 23:21 - 00000000 ____D () C:\searchplugins
2015-01-21 23:02 - 2015-01-21 23:02 - 00004648 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpService.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\LavasoftStatistics
2015-01-21 23:02 - 2014-12-16 12:10 - 00358736 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2015-01-21 23:02 - 2014-12-16 12:10 - 00312424 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll
2015-01-21 22:59 - 2015-01-21 23:21 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-01-21 22:59 - 2015-01-21 22:59 - 01937320 _____ () C:\Users\Gregor\Downloads\AdAware115WebInstaller.exe
2015-01-20 20:18 - 2015-01-24 16:23 - 00000000 ____D () C:\AdwCleaner
2015-01-20 20:01 - 2015-01-20 20:01 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-20 20:00 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Downloads\JRT.exe
2015-01-20 18:25 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-01-20 18:25 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\ProgramData\ZDSupport
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\Program Files (x86)\Hostless Modem
2015-01-13 22:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:30 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:30 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-08 18:55 - 2015-01-08 18:55 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Avg
2015-01-02 18:45 - 2015-01-02 18:45 - 00000791 _____ () C:\Users\Gregor\Desktop\Soulful.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-25 21:45 - 2013-12-11 15:05 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-25 21:41 - 2013-12-14 11:19 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{27D26F56-1E79-48C6-844C-D4E9DBC2810B}
2015-01-25 21:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-25 20:19 - 2013-12-11 15:06 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-25 20:18 - 2013-12-14 11:08 - 00000000 ___DO () C:\Users\Gregor\SkyDrive
2015-01-24 16:49 - 2013-12-11 14:47 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4223944866-4218211989-4134806692-1001
2015-01-24 16:25 - 2013-11-14 08:26 - 01789004 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-24 16:25 - 2013-11-14 08:11 - 00768888 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-24 16:25 - 2013-11-14 08:11 - 00160706 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-24 16:20 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-24 14:15 - 2013-12-16 21:24 - 02610176 ___SH () C:\Users\Gregor\Desktop\Thumbs.db
2015-01-24 13:47 - 2014-11-29 12:18 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Deployment
2015-01-24 13:45 - 2014-11-29 12:20 - 06291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2015-01-24 13:45 - 2014-11-29 12:20 - 01572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2015-01-24 13:44 - 2014-11-29 14:10 - 00022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2015-01-24 13:44 - 2014-11-29 12:19 - 00002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2015-01-24 13:38 - 2013-12-14 10:58 - 00000000 ____D () C:\Users\Gregor
2015-01-24 13:38 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-24 12:57 - 2014-08-27 18:20 - 00000174 _____ () C:\WINDOWS\setscan.ini
2015-01-24 12:22 - 2013-12-14 23:26 - 11798528 _____ () C:\Users\Gregor\Documents\Finanzen.mny
2015-01-24 12:09 - 2013-12-26 10:13 - 00000000 ____D () C:\Program Files (x86)\Chord Pro Manager
2015-01-24 09:45 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-24 08:59 - 2013-12-14 11:42 - 00151032 _____ () C:\Users\Gregor\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-24 08:57 - 2013-08-22 15:44 - 00610976 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-24 01:12 - 2013-12-14 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-01-24 01:12 - 2013-12-14 11:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Samsung
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-01-24 00:48 - 2013-12-11 14:57 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-24 00:27 - 2014-11-30 09:23 - 11801792 ____R () C:\Users\Gregor\Money Backup 30.11.2014.mbf
2015-01-24 00:14 - 2014-08-24 17:59 - 00000000 ____D () C:\Users\Gregor\Desktop\Evernote Sync
2015-01-24 00:00 - 2013-12-12 12:20 - 00000000 ____D () C:\ProgramData\Advanced
2015-01-23 23:40 - 2013-12-13 22:17 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-23 23:17 - 2014-04-02 17:07 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\AIMP3
2015-01-23 23:17 - 2013-12-14 10:56 - 00000000 ___DC () C:\WINDOWS\Panther
2015-01-23 23:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Resources
2015-01-23 23:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Performance
2015-01-21 23:11 - 2013-12-11 16:09 - 01807894 _____ () C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2015-01-21 22:48 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-21 22:20 - 2014-08-24 15:41 - 00000000 ____D () C:\Program Files (x86)\Evernote
2015-01-21 19:18 - 2014-08-24 16:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Skitch
2015-01-20 23:15 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-20 21:30 - 2014-01-04 20:18 - 00000000 ____D () C:\temp
2015-01-20 19:57 - 2013-12-11 15:12 - 00000000 ____D () C:\Users\Gregor\VMLites
2015-01-20 18:24 - 2013-12-11 15:46 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-20 18:23 - 2013-12-11 15:46 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-19 22:32 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-19 22:32 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-14 22:45 - 2013-12-11 15:05 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-01-10 23:18 - 2014-02-28 14:27 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\vlc
2015-01-08 18:56 - 2014-03-31 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-02 18:43 - 2013-12-17 22:06 - 00175104 ___SH () C:\Users\Gregor\Downloads\Thumbs.db

==================== Files in the root of some directories =======

2014-05-02 18:11 - 2014-06-15 13:23 - 0560516 _____ () C:\Users\Gregor\AppData\Roaming\Scorch_Install.log
2013-12-27 15:14 - 2013-12-28 11:30 - 0001323 _____ () C:\Users\Gregor\AppData\Roaming\songpress.ini
2014-11-29 14:10 - 2015-01-24 13:44 - 0022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2014-11-29 12:19 - 2015-01-24 13:44 - 0002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2014-11-29 12:20 - 2015-01-24 13:45 - 6291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2014-11-29 12:20 - 2015-01-24 13:45 - 1572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2013-12-14 10:57 - 2013-12-14 10:57 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-21 20:02

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Gregor at 2015-01-25 21:51:48
Running from C:\Users\Gregor\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.280 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1345, 26.03.2014 - AIMP DevTeam)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4257 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon driver for P-215 (x64) (HKLM\...\{CB884F7A-3B20-43EF-9B46-0663A28EDF1A}) (Version: 1.2.4706 - Canon Electronics Inc.)
Canon iP4700 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series) (Version:  - )
CaptureOnTouch Evernote Plugin (HKLM-x32\...\{CE27CA2B-7663-4F6B-8E61-A455390AC71F}) (Version: 1.2.11005 - Canon Electronics Inc.)
CaptureOnTouch Google Docs(TM) Plugin (HKLM-x32\...\{31DAEBE6-4FF6-487F-8AB9-3BEFB9B863D1}) (Version: 1.3.4625 - Canon Electronics Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chord Pro Manager (HKLM-x32\...\ST6UNST #1) (Version:  - )
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\CopyTrans Suite) (Version: 3.003 - WindSolutions)
DDBAC (HKLM-x32\...\{4C19650D-1BF8-4459-A904-06FB692B0F8E}) (Version: 5.3.24 - DataDesign)
DDBAC (HKLM-x32\...\{88A0F52F-A024-4268-977E-E75B1F9C67ED}) (Version: 5.3.28 - DataDesign)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version:  - Steinberg Media Technologies GmbH)
Evernote v. 5.7.2 (HKLM-x32\...\{FB57263E-706F-11E4-A65F-00163E98E7D6}) (Version: 5.7.2.5753 - Evernote Corp.)
Finale Allegro 2005 (HKLM-x32\...\Finale Allegro 2005) (Version:  - )
Garmin Communicator Plugin (HKLM-x32\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin x64 (HKLM\...\{70A381F1-C161-4D61-A20C-BE12FC6777DF}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM-x32\...\{7D542452-84EB-47C0-97BA-735C523AB555}) (Version: 3.6.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HBCI-Modul für Money 99 Version 2000 (HKLM-x32\...\{8A13EBF6-6249-4C0D-92BE-F8497C922311}_is1) (Version: 5.0.1.10 - Dr. Ulrich Amann)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Money 99 (HKLM-x32\...\MSMONEYV70) (Version:  - )
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Communicator 2007 (HKLM-x32\...\{0FCA0973-24C0-48EA-8CF6-71B53C135C09}) (Version: 2.0.6362.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Money-Browser für Money 99 Version 2000 3.0.1.37 (HKLM-x32\...\{E9E9FCFC-9F1A-4EDC-8400-2EAB5A9DEB4F}_is1) (Version: 3.0.1.37 - Dr. Ulrich Amann)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)
P-215 CaptureOnTouch (HKLM-x32\...\{551DCCF1-A5D6-4090-86A5-38EA6EB5AC18}) (Version: 2.3.212.727 - Canon Electronics Inc.)
P-215 UserManual (HKLM-x32\...\{B00EDF44-C4C7-4857-872D-4C8459AD589B}) (Version: 1.05.0000 - Canon Electronics Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PaperPort SharePoint Link (HKLM-x32\...\{8D09F3C8-C890-4118-B3CC-697BE7FA0421}) (Version: 12.000.0001 - Nuance Communications, Inc.)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM-x32\...\{EA820D43-3E3F-4B16-BAA2-DCAB0D4E7F1A}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Setup-Loader für das HBCI-Modul für Money 99 Version 2000 3.4 (HKLM-x32\...\Setup-Loader für das HBCI-Modul für Money 99 Version 2000_is1) (Version: 3.4 - Dr. Ulrich Amann)
Sibelius Scorch (Firefox, Opera, Netscape, Chrome only) (HKLM-x32\...\{41626CC0-A854-4402-AD06-D7939515C282}) (Version: 6.2.0 - Sibelius Software, a division of Avid Technology, Inc.)
SportTracks 3.1 (HKLM-x32\...\{99895EF0-B290-4B21-B1FE-FB00E1B5D195}) (Version: 3.1.5349 - Zone Five Software)
Stardock Start8 (HKLM-x32\...\Stardock Start8) (Version: 1.45 - Stardock Software, Inc.)
Steinberg Upload Manager (HKLM-x32\...\{88BBBD8F-4C19-4809-B84B-7A8F8238B48D}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
Transcribe! 8.40 (HKLM-x32\...\Transcribe!_is1) (Version: 8.40 - Seventh String Software)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VMLite Workstation (HKLM\...\{197F2BEF-2705-406E-8CEB-8E404FFFE414}) (Version: 3.2.6 - VMLite)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{4F9EFA88-960A-41FA-B56C-FE993D861FA6}) (Version: 21.00.8480 - Buhl Data Service GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

12-01-2015 18:14:07 Geplanter Prüfpunkt
15-01-2015 18:25:52 Windows Update
18-01-2015 23:48:34 Windows Update
21-01-2015 22:22:28 Removed Google Earth.
24-01-2015 00:00:04 Removed Shark007 Advanced Codecs.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {021E431F-94F7-4185-9C82-8EFBA4DA5C1B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {161E825F-E2AA-4175-BC1F-4D03F9100354} - System32\Tasks\{ABD1FC5D-F115-4312-B835-5F72B0F06AF4} => pcalua.exe -a "C:\Users\Gregor\Downloads\4200fvst648620a_64de (1).exe" -d C:\Users\Gregor\Downloads
Task: {1A375487-EF08-4A15-8F70-1A4A42A70C3C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {25A85C4D-8964-40AF-8CEA-D0460D6289D0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-23] (Google Inc.)
Task: {74650E97-E9EB-4BB7-9433-4ED6150CAFBD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {7A45A7A8-4288-490C-8299-A7F713F83303} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {8313ECDA-A864-4051-999F-CAF2FFE9D945} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {8B87EC0D-B85A-44B1-92CD-A450FAF8E1C2} - System32\Tasks\{719118DA-0CB0-4201-9147-FC0A6DF78DC1} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64en.exe -d C:\Users\Gregor\Downloads
Task: {ABA0824B-9509-4D54-8A2A-9ED32C299005} - System32\Tasks\{85AB14EB-242A-4810-BD1C-583A453A67DE} => pcalua.exe -a C:\Users\Gregor\Downloads\USBDrivers_231.exe -d C:\Users\Gregor\Downloads
Task: {B1DF5B7B-A9B2-4C1B-884A-5EEC2C435BDA} - System32\Tasks\{A9C356FA-DEB4-4F61-9E59-27C969DEC297} => pcalua.exe -a E:\Scangear\German\SetupSG.exe -d E:\Scangear\German
Task: {C306D80E-A5E0-4838-B3B3-556019779A6A} - System32\Tasks\{090D3749-44DF-4ED3-80AB-291B6A2A604E} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64de\SetupSG.exe -d C:\Users\Gregor\Downloads\4200fvst648620a_64de
Task: {E88E8EB2-C733-4E9A-B639-1761E1A2EBB8} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-20] (Microsoft Corporation)
Task: {F73BD0F3-8AE0-4712-A9B3-3AF2DB03D345} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-10 17:45 - 2006-06-27 16:28 - 00322048 _____ () C:\WINDOWS\system32\CNQL3203.DLL
2010-08-11 14:18 - 2010-08-11 14:18 - 00202344 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxDDU.dll
2010-08-11 14:18 - 2010-08-11 14:18 - 02725480 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxRT.dll
2009-03-26 22:03 - 2009-03-26 22:03 - 01289728 _____ () C:\Program Files\VMLite\VMLite Workstation\LIBEAY32.dll
2013-10-07 14:52 - 2013-10-07 14:52 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-22 08:19 - 2013-08-22 07:54 - 00174592 _____ () C:\WINDOWS\system32\WinMetadata\Windows.UI.winmd
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-04-04 18:54 - 2012-04-04 18:54 - 00015360 _____ () C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\SSLSupport.dll
2015-01-24 10:26 - 2015-01-24 10:26 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\c89a3da49bf7bd161745f4228277ea00\PSIClient.ni.dll
2013-12-11 15:01 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00438336 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00320064 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2015-01-23 23:40 - 2015-01-21 04:50 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libglesv2.dll
2015-01-23 23:40 - 2015-01-21 04:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libegl.dll
2015-01-23 23:40 - 2015-01-21 04:50 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\All Users:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Application Data:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\Gregor\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "WISO Mein Steuer-Sparbuch heute.lnk"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKLM\...\StartupApproved\Run32: => "OpwareSE2"
HKLM\...\StartupApproved\Run32: => "OPSE reminder"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesPreload"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesAirMessage"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "Reminder"

========================= Accounts: ==========================

Administrator (S-1-5-21-4223944866-4218211989-4134806692-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-4223944866-4218211989-4134806692-501 - Limited - Disabled)
Gregor (S-1-5-21-4223944866-4218211989-4134806692-1001 - Administrator - Enabled) => C:\Users\Gregor
HomeGroupUser$ (S-1-5-21-4223944866-4218211989-4134806692-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Netzwerkcontroller
Description: Netzwerkcontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/25/2015 09:33:05 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm NOTEPAD.EXE, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 110c

Startzeit: 01d038ddf0fa7c21

Endzeit: 0

Anwendungspfad: C:\WINDOWS\system32\NOTEPAD.EXE

Berichts-ID: 59baed7c-a4d1-11e4-beb5-bc5ff4a1c658

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (01/25/2015 09:31:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (01/25/2015 08:55:53 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (01/25/2015 08:46:02 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (01/25/2015 08:40:14 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (01/25/2015 08:40:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (01/25/2015 08:40:06 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (01/25/2015 08:32:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (01/25/2015 08:32:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (01/25/2015 08:32:32 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (12/31/2014 06:26:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 565 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (08/30/2014 01:19:56 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 0 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3245 CPU @ 3.40GHz
Percentage of memory in use: 30%
Total physical RAM: 7873.64 MB
Available physical RAM: 5484.39 MB
Total Pagefile: 9089.64 MB
Available Pagefile: 6489.84 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (SYSTEM) (Fixed) (Total:111.45 GB) (Free:61.61 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:465.76 GB) (Free:465.11 GB) NTFS
Drive f: (Festplatte) (Fixed) (Total:698.64 GB) (Free:565.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 7CA3E6EF)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: BF66C29B)
Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 7CA3E6FA)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 26.01.2015, 11:28

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

amigo54 · 27.01.2015, 00:08

Erst einmal "Vielen Dank für die bisherige Hilfe!" ;-)

Habe die angegebenen Schritte durchgeführt.

Nachdem ich Chrome mit Revo de-installiert hatte wurde ein Fenster im Internet-Explorer geöffnet und dort angezeigt, dass versucht wurde, ein Google-Fenster zu öffnen.

Habe dann die Browser-Einstellungen wie beschrieben gelöscht.

Dennoch wurde eben gerade zwei-, dreimal wieder ein neues Fenster geöffnet. Offensichtlich scheint von irgendeiner Stelle immer noch Google aufgerufen zu werden. Zumindest ist jedoch im frst-logfile der anfangs beschriebene Eintrag

CHR HomePage: Default -> hxxp://start.iminent.com/?appId=3E8BB516-CB92-48AD-A6C2-12C7A9C906B4

verschwunden.

Ist wohl ein hartnäckiger Fall

Viele Grüße

Nachtrag:

Habe grad mit der Suchfunktion auf dem PC nach iminent gesucht und wieder 3 Einträge gefunden:

IMINENTMINIBARIE[1].EXE-EEF04077.pf in C:\Benutzer\Gregor\Appdata\Roaming\Microsoft\Windows

IMINENTMINIBARIE[1].EXE-EEF04077.pf in C:\Benutzer\Gregor\

und

IMINENTMINIBARIE[1].EXE-EEF04077.pf ohne weitere Angaben.

Nach dem Löschen wird der Eintrag wieder neu hergestellt ;-(

Vor zwei oder 3 Tagen wurde bei der Suche nichts gefunden....

schrauber · 27.01.2015, 11:43

Etwas verwirrend der Text

Chrome wurde wieder neu installiert und dann zurückgesetzt?
und immer noch probleme in Chrome?

amigo54 · 27.01.2015, 22:20

Ups, hab ich mich so verwirrend ausgedrückt? ;-(

Ich versuche es nochmal:

Chrome wurde deinstalliert und zurückgesetzt.
Dennoch gab es immer noch Popups...

Da ich den Iminent Toolbar im Verdacht hatte (der war mir ganz am Anfang aufgefallen), habe ich nochmals danach gesucht und an 3 Stellen gefunden.

Das Löschen war zwecklos, da die Einträge kurz darauf wieder da waren.

Soweit mein bisheriger Bericht.

Danach habe ich die Registrierung durchsucht und tatsächlich den Eintrag IMINENTMINIBARIE gefunden.

Den habe ich gelöscht und seitdem (scheint) Ruhe zu sein. ;-)
Ich hoffe, dass sich nicht noch irgendwo etwas versteckt hat.

Bis hierhin schon mal herzlichen Dank für die Hilfe !!!
Viele Grüße

schrauber · 28.01.2015, 10:56

Ok, vorab:

Verbindest Du Chrome mit einem Google Konto?

amigo54 · 28.01.2015, 11:17

Über Chrome greife ich zumindest auf mein Google Konto zu.

Bei der letzten Neu-Installation von Chrome wurde wieder angeboten, dies mit gewissen Inhalten zu synchronisieren (ich glaube das sind zumindest Verläufe und Links).
Da ich befürchtete, mir auf diese Art und Weise vielleicht wieder etwas auf meinen Rechner zu ziehen (zB ein Link auf den o.a. Toolbar), habe ich das abgelehnt.

Ich weiß natürlich nicht, was Google in dieser Hinsicht so im Hintergrund treibt und miteinander verknüpft - es wird aber einiges sein. Da an dem Google Konto auch mein Handy dran hängt, gibt es schon verschiedene Verbindungen, über die man sich etwas einfangen kann. ;-(

Viele Grüße

schrauber · 28.01.2015, 13:40

Das Google Konto synct alles, auch die Adware, wieder in den Browser.

Chrome öffnen, Konto auf jeden Fall verbinden!!.

Dann in die Einstellungen und erweiterten Einstellungen von Chrome gehen, alles rauslöschen was nicht da hingehört. und dann bei verbundenem Konto nochmal Chrome komplett zurücksetzen.

Dann bitte ein frisches FRST Log und nochmal berichten.

amigo54 · 28.01.2015, 22:48

Nochmals vielen Dank, für die schnellen Hilfestellungen!

Seit meinem letzten Beitrag gab es keine PopUps mehr.

Habe die angegebenen Schritte in Chrome durchgeführt.

Bis jetzt ist mir nichts Verdächtiges aufgefallen.

Viele Grüße

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by Gregor (administrator) on USER-PC on 28-01-2015 22:41:39
Running from C:\Users\Gregor\Downloads
Loaded Profiles: Gregor (Available profiles: Gregor & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe
(Stardock Software, Inc) C:\Program Files (x86)\Stardock\Start8\Start8_64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(VMLite, Inc.) C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(EMC Corporation) C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Canon Electronics Inc.) C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Money\System\REMINDER.EXE


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [CANON DR-P215 SVC] => rundll32.exe PHCSVC.DLL,EntryPointUserMessage
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133408 2012-09-11] (Intel Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [P-215 CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\P215\TouchDR.exe [966656 2012-07-19] (Canon Electronics Inc.)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2009-03-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => D:\Software\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [Reminder] => C:\Program Files (x86)\Microsoft Money\System\reminder.exe [37376 1999-03-15] (Microsoft Corporation)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef3d-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\MountPoints2: {bd2fef5a-990a-11e4-beaa-bc5ff4a1c658} - "G:\AutoRun.exe" 
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
ShortcutTarget: Adobe Gamma Loader.exe.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Gregor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_280.dll ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_280.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> D:\Software\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> F:\FoxitReader\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll No File
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @Sibelius.com/Scorch Plugin,version=6.2.0.88 -> C:\Program Files (x86)\Sibelius Software\Scorch\npsibelius.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Docs) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-28]
CHR Extension: (Google Drive) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-28]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-28]
CHR Extension: (YouTube) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-28]
CHR Extension: (Google-Suche) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-28]
CHR Extension: (Google Mail) - C:\Users\Gregor\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 Emc.Captiva.WebCaptureService; C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe [39936 2012-04-04] (EMC Corporation) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 Start8; C:\Program Files (x86)\Stardock\Start8\Start8Srv.exe [143288 2014-06-18] (Stardock Software, Inc)
R2 VMLiteService; C:\Program Files\VMLite\VMLite Workstation\VMLiteService.exe [426600 2010-08-21] (VMLite, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 asahci64; C:\Windows\System32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-28] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R1 VBoxDrv; C:\Windows\System32\drivers\VBoxDrv.sys [204328 2010-08-11] (VMLite, Inc.)
R3 VBoxNetAdp; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [146216 2010-08-11] (VMLite, Inc.)
R3 VBoxNetFlt; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [165800 2010-08-11] (VMLite, Inc.)
R1 vmlitedrv; C:\Windows\System32\drivers\vmlitedrv.sys [14952 2010-08-03] (VMLite, Inc.)
R3 vmlitestor; C:\Windows\system32\DRIVERS\vmlitestor.sys [177768 2010-08-11] (VMLite, Inc.)
R1 VMLiteUSBMon; C:\Windows\System32\drivers\vmliteusbmon.sys [135272 2010-08-18] (VMLite, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 22:41 - 2015-01-28 22:41 - 00016837 _____ () C:\Users\Gregor\Downloads\FRST.txt
2015-01-27 23:02 - 2015-01-27 23:03 - 00000000 ____D () C:\Users\Gregor\Desktop\Neuer Ordner
2015-01-27 23:01 - 2015-01-27 23:03 - 00000000 ____D () C:\Users\Gregor\Desktop\Eventuell brauchbar
2015-01-27 22:31 - 2015-01-27 23:02 - 00000000 ____D () C:\Users\Gregor\Desktop\Noten Ebi
2015-01-27 00:19 - 2015-01-27 00:26 - 00000326 _____ () C:\WINDOWS\Tasks\FreeFixer background scan.job
2015-01-27 00:19 - 2015-01-27 00:20 - 00000000 ____D () C:\Users\Gregor\AppData\Local\FreeFixer
2015-01-27 00:19 - 2015-01-27 00:19 - 00002972 _____ () C:\WINDOWS\System32\Tasks\FreeFixer background scan
2015-01-27 00:19 - 2015-01-27 00:19 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeFixer
2015-01-27 00:19 - 2015-01-27 00:19 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\FreeFixer
2015-01-27 00:19 - 2015-01-27 00:19 - 00000000 ____D () C:\Program Files\FreeFixer
2015-01-27 00:18 - 2015-01-27 00:18 - 02666167 _____ (Kephyr) C:\Users\Gregor\Downloads\freefixersetup.exe
2015-01-26 23:36 - 2015-01-27 21:42 - 00002201 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-26 23:36 - 2015-01-26 23:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-26 23:35 - 2015-01-28 22:40 - 00001126 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-26 23:35 - 2015-01-28 21:30 - 00001122 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-26 23:35 - 2015-01-26 23:35 - 00004098 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-26 23:35 - 2015-01-26 23:35 - 00003862 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-25 21:33 - 2015-01-25 20:32 - 00852504 _____ () C:\Users\Gregor\Desktop\SecurityCheck.exe
2015-01-25 20:31 - 2015-01-25 20:32 - 00852504 _____ () C:\Users\Gregor\Downloads\SecurityCheck.exe
2015-01-25 20:31 - 2015-01-25 20:31 - 02347384 _____ (ESET) C:\Users\Gregor\Downloads\esetsmartinstaller_deu.exe
2015-01-24 16:26 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Desktop\JRT.exe
2015-01-24 16:20 - 2015-01-28 21:30 - 00000308 _____ () C:\WINDOWS\setupact.log
2015-01-24 16:20 - 2015-01-27 00:26 - 00001352 _____ () C:\WINDOWS\PFRO.log
2015-01-24 16:20 - 2015-01-24 16:20 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-01-24 16:16 - 2015-01-24 16:16 - 02194432 _____ () C:\Users\Gregor\Downloads\adwcleaner_4.109.exe
2015-01-24 15:04 - 2015-01-24 15:04 - 00000474 _____ () C:\Users\Gregor\Downloads\defogger_disable.log
2015-01-24 14:33 - 2015-01-28 21:52 - 00650131 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-24 13:44 - 2015-01-24 13:44 - 03494400 _____ () C:\Users\Gregor\Documents\QC_150124134449.bak
2015-01-24 13:08 - 2015-01-24 13:08 - 00380416 _____ () C:\Users\Gregor\Downloads\52n0jlfl.exe
2015-01-24 13:01 - 2015-01-28 22:41 - 00000000 ____D () C:\Users\Gregor\Downloads\FRST-OlderVersion
2015-01-24 13:00 - 2015-01-24 13:00 - 00000000 _____ () C:\Users\Gregor\defogger_reenable
2015-01-24 09:21 - 2015-01-24 09:21 - 00050477 _____ () C:\Users\Gregor\Downloads\Defogger.exe
2015-01-24 08:49 - 2015-01-24 08:54 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Nico Mak Computing
2015-01-24 08:44 - 2015-01-28 22:04 - 11818176 ____R () C:\Users\Gregor\Money Backup 24.01.2015.mbf
2015-01-24 00:44 - 2015-01-24 00:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (2).exe
2015-01-24 00:44 - 2015-01-24 00:44 - 00001290 _____ () C:\Users\Gregor\Desktop\Revo Uninstaller.lnk
2015-01-23 23:15 - 2015-01-23 23:15 - 04188536 _____ (Piriform Ltd) C:\Users\Gregor\Downloads\ccsetup501_slim.exe
2015-01-23 23:15 - 2015-01-23 23:15 - 00002774 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2015-01-23 23:15 - 2015-01-23 23:15 - 00000840 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-23 23:15 - 2015-01-23 23:15 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-23 23:14 - 2015-01-24 00:44 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95.exe
2015-01-23 23:13 - 2015-01-23 23:13 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gregor\Downloads\revosetup95 (1).exe
2015-01-23 23:11 - 2015-01-28 22:41 - 02130432 _____ (Farbar) C:\Users\Gregor\Downloads\FRST64.exe
2015-01-23 23:11 - 2015-01-28 22:41 - 00000000 ____D () C:\FRST
2015-01-23 22:53 - 2015-01-28 21:56 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-23 22:53 - 2015-01-23 22:53 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-23 22:53 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-23 22:53 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-23 22:52 - 2015-01-23 22:52 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Gregor\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-21 23:02 - 2015-01-21 23:21 - 00000213 _____ () C:\prefs.js
2015-01-21 23:02 - 2015-01-21 23:21 - 00000000 ____D () C:\searchplugins
2015-01-21 23:02 - 2015-01-21 23:02 - 00004648 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpService.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00002480 _____ () C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2015-01-21 23:02 - 2015-01-21 23:02 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\LavasoftStatistics
2015-01-21 23:02 - 2014-12-16 12:10 - 00358736 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2015-01-21 23:02 - 2014-12-16 12:10 - 00312424 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll
2015-01-21 22:59 - 2015-01-21 23:21 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-01-21 22:59 - 2015-01-21 22:59 - 01937320 _____ () C:\Users\Gregor\Downloads\AdAware115WebInstaller.exe
2015-01-20 20:18 - 2015-01-24 16:23 - 00000000 ____D () C:\AdwCleaner
2015-01-20 20:01 - 2015-01-20 20:01 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-20 20:00 - 2015-01-20 20:00 - 01707939 _____ (Thisisu) C:\Users\Gregor\Downloads\JRT.exe
2015-01-20 18:25 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-01-20 18:25 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\ProgramData\ZDSupport
2015-01-15 17:53 - 2015-01-21 23:20 - 00000000 ____D () C:\Program Files (x86)\Hostless Modem
2015-01-13 22:31 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:31 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:31 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:31 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:31 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:31 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:31 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:31 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:30 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:30 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:30 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:30 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:30 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:30 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:30 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:30 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:30 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-08 18:55 - 2015-01-08 18:55 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Avg
2015-01-02 18:45 - 2015-01-02 18:45 - 00000791 _____ () C:\Users\Gregor\Desktop\Soulful.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 22:04 - 2013-12-14 23:26 - 11814912 _____ () C:\Users\Gregor\Documents\Finanzen.mny
2015-01-28 22:03 - 2013-12-11 14:47 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4223944866-4218211989-4134806692-1001
2015-01-28 22:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-28 21:45 - 2013-12-11 15:05 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-01-28 21:35 - 2013-12-11 15:06 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-28 21:34 - 2013-11-14 08:26 - 01789004 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-28 21:34 - 2013-11-14 08:11 - 00768888 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-28 21:34 - 2013-11-14 08:11 - 00160706 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-28 21:33 - 2013-12-14 11:19 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{27D26F56-1E79-48C6-844C-D4E9DBC2810B}
2015-01-28 21:30 - 2013-12-14 11:08 - 00000000 ___DO () C:\Users\Gregor\SkyDrive
2015-01-28 21:30 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-28 21:30 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-28 21:29 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-27 23:15 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-27 23:01 - 2013-12-26 10:13 - 00000000 ____D () C:\Program Files (x86)\Chord Pro Manager
2015-01-26 23:36 - 2013-12-13 22:17 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-26 23:35 - 2014-11-29 12:18 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Deployment
2015-01-24 21:20 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-24 14:15 - 2013-12-16 21:24 - 02610176 ___SH () C:\Users\Gregor\Desktop\Thumbs.db
2015-01-24 13:45 - 2014-11-29 12:20 - 06291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2015-01-24 13:45 - 2014-11-29 12:20 - 01572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2015-01-24 13:44 - 2014-11-29 14:10 - 00022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2015-01-24 13:44 - 2014-11-29 14:10 - 00012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2015-01-24 13:44 - 2014-11-29 12:20 - 00004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2015-01-24 13:44 - 2014-11-29 12:19 - 00002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2015-01-24 13:38 - 2013-12-14 10:58 - 00000000 ____D () C:\Users\Gregor
2015-01-24 12:57 - 2014-08-27 18:20 - 00000174 _____ () C:\WINDOWS\setscan.ini
2015-01-24 08:59 - 2013-12-14 11:42 - 00151032 _____ () C:\Users\Gregor\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-24 08:57 - 2013-08-22 15:44 - 00610976 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-24 01:12 - 2013-12-14 11:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-01-24 01:12 - 2013-12-14 11:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\Samsung
2015-01-24 00:48 - 2013-12-15 17:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Samsung
2015-01-24 00:48 - 2013-12-15 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-01-24 00:48 - 2013-12-11 14:57 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-24 00:27 - 2014-11-30 09:23 - 11801792 ____R () C:\Users\Gregor\Money Backup 30.11.2014.mbf
2015-01-24 00:14 - 2014-08-24 17:59 - 00000000 ____D () C:\Users\Gregor\Desktop\Evernote Sync
2015-01-24 00:00 - 2013-12-12 12:20 - 00000000 ____D () C:\ProgramData\Advanced
2015-01-23 23:17 - 2014-04-02 17:07 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\AIMP3
2015-01-23 23:17 - 2013-12-14 10:56 - 00000000 ___DC () C:\WINDOWS\Panther
2015-01-23 23:09 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Resources
2015-01-23 23:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Performance
2015-01-21 23:11 - 2013-12-11 16:09 - 01807894 _____ () C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2015-01-21 22:48 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-21 22:20 - 2014-08-24 15:41 - 00000000 ____D () C:\Program Files (x86)\Evernote
2015-01-21 19:18 - 2014-08-24 16:05 - 00000000 ____D () C:\Users\Gregor\AppData\Local\Skitch
2015-01-20 21:30 - 2014-01-04 20:18 - 00000000 ____D () C:\temp
2015-01-20 19:57 - 2013-12-11 15:12 - 00000000 ____D () C:\Users\Gregor\VMLites
2015-01-20 18:24 - 2013-12-11 15:46 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-20 18:23 - 2013-12-11 15:46 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-14 22:45 - 2013-12-11 15:05 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-01-10 23:18 - 2014-02-28 14:27 - 00000000 ____D () C:\Users\Gregor\AppData\Roaming\vlc
2015-01-08 18:56 - 2014-03-31 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-02 18:43 - 2013-12-17 22:06 - 00175104 ___SH () C:\Users\Gregor\Downloads\Thumbs.db

==================== Files in the root of some directories =======

2014-05-02 18:11 - 2014-06-15 13:23 - 0560516 _____ () C:\Users\Gregor\AppData\Roaming\Scorch_Install.log
2013-12-27 15:14 - 2013-12-28 11:30 - 0001323 _____ () C:\Users\Gregor\AppData\Roaming\songpress.ini
2014-11-29 14:10 - 2015-01-24 13:44 - 0022374 _____ () C:\Users\Gregor\AppData\Local\Layout.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0019484 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0021988 _____ () C:\Users\Gregor\AppData\Local\LayoutPanels_Default.xml
2014-11-29 14:10 - 2015-01-24 13:44 - 0012573 _____ () C:\Users\Gregor\AppData\Local\Layout_Card.xml
2014-11-29 12:20 - 2015-01-24 13:44 - 0004387 _____ () C:\Users\Gregor\AppData\Local\QC.ini
2014-11-29 12:19 - 2015-01-24 13:44 - 0002970 _____ () C:\Users\Gregor\AppData\Local\QC.log
2014-11-29 12:20 - 2015-01-24 13:45 - 6291456 _____ () C:\Users\Gregor\AppData\Local\QC.mdf
2014-11-29 12:20 - 2015-01-24 13:45 - 1572864 _____ () C:\Users\Gregor\AppData\Local\QC_log.ldf
2013-12-14 10:57 - 2013-12-14 10:57 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-21 20:02

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by Gregor at 2015-01-28 22:42:01
Running from C:\Users\Gregor\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.280 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AIMP3 (HKLM-x32\...\AIMP3) (Version: v3.55.1345, 26.03.2014 - AIMP DevTeam)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4257 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon driver for P-215 (x64) (HKLM\...\{CB884F7A-3B20-43EF-9B46-0663A28EDF1A}) (Version: 1.2.4706 - Canon Electronics Inc.)
Canon iP4700 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series) (Version:  - )
CaptureOnTouch Evernote Plugin (HKLM-x32\...\{CE27CA2B-7663-4F6B-8E61-A455390AC71F}) (Version: 1.2.11005 - Canon Electronics Inc.)
CaptureOnTouch Google Docs(TM) Plugin (HKLM-x32\...\{31DAEBE6-4FF6-487F-8AB9-3BEFB9B863D1}) (Version: 1.3.4625 - Canon Electronics Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Chord Pro Manager (HKLM-x32\...\ST6UNST #1) (Version:  - )
CopyTrans Control Center deinstallieren (HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\CopyTrans Suite) (Version: 3.003 - WindSolutions)
DDBAC (HKLM-x32\...\{4C19650D-1BF8-4459-A904-06FB692B0F8E}) (Version: 5.3.24 - DataDesign)
DDBAC (HKLM-x32\...\{88A0F52F-A024-4268-977E-E75B1F9C67ED}) (Version: 5.3.28 - DataDesign)
eLicenser Control (HKLM-x32\...\eLicenser Control) (Version:  - Steinberg Media Technologies GmbH)
Evernote v. 5.7.2 (HKLM-x32\...\{FB57263E-706F-11E4-A65F-00163E98E7D6}) (Version: 5.7.2.5753 - Evernote Corp.)
Finale Allegro 2005 (HKLM-x32\...\Finale Allegro 2005) (Version:  - )
FreeFixer (HKLM-x32\...\FreeFixer1.12) (Version: 1.12 - Kephyr)
Garmin Communicator Plugin (HKLM-x32\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin x64 (HKLM\...\{70A381F1-C161-4D61-A20C-BE12FC6777DF}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin Training Center (HKLM-x32\...\{7D542452-84EB-47C0-97BA-735C523AB555}) (Version: 3.6.5 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Garmin WebUpdater (HKLM-x32\...\{AE1EC58E-B2AC-4959-A4C2-C38202A25239}) (Version: 2.5.6 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HBCI-Modul für Money 99 Version 2000 (HKLM-x32\...\{8A13EBF6-6249-4C0D-92BE-F8497C922311}_is1) (Version: 5.0.1.10 - Dr. Ulrich Amann)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Money 99 (HKLM-x32\...\MSMONEYV70) (Version:  - )
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Communicator 2007 (HKLM-x32\...\{0FCA0973-24C0-48EA-8CF6-71B53C135C09}) (Version: 2.0.6362.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Money-Browser für Money 99 Version 2000 3.0.1.37 (HKLM-x32\...\{E9E9FCFC-9F1A-4EDC-8400-2EAB5A9DEB4F}_is1) (Version: 3.0.1.37 - Dr. Ulrich Amann)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)
P-215 CaptureOnTouch (HKLM-x32\...\{551DCCF1-A5D6-4090-86A5-38EA6EB5AC18}) (Version: 2.3.212.727 - Canon Electronics Inc.)
P-215 UserManual (HKLM-x32\...\{B00EDF44-C4C7-4857-872D-4C8459AD589B}) (Version: 1.05.0000 - Canon Electronics Inc.)
PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PaperPort SharePoint Link (HKLM-x32\...\{8D09F3C8-C890-4118-B3CC-697BE7FA0421}) (Version: 12.000.0001 - Nuance Communications, Inc.)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.) Hidden
ScanSoft PaperPort 11 (HKLM-x32\...\{EA820D43-3E3F-4B16-BAA2-DCAB0D4E7F1A}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Setup-Loader für das HBCI-Modul für Money 99 Version 2000 3.4 (HKLM-x32\...\Setup-Loader für das HBCI-Modul für Money 99 Version 2000_is1) (Version: 3.4 - Dr. Ulrich Amann)
Sibelius Scorch (Firefox, Opera, Netscape, Chrome only) (HKLM-x32\...\{41626CC0-A854-4402-AD06-D7939515C282}) (Version: 6.2.0 - Sibelius Software, a division of Avid Technology, Inc.)
SportTracks 3.1 (HKLM-x32\...\{99895EF0-B290-4B21-B1FE-FB00E1B5D195}) (Version: 3.1.5349 - Zone Five Software)
Stardock Start8 (HKLM-x32\...\Stardock Start8) (Version: 1.45 - Stardock Software, Inc.)
Steinberg Upload Manager (HKLM-x32\...\{88BBBD8F-4C19-4809-B84B-7A8F8238B48D}) (Version: 1.0.1 - Steinberg Media Technologies GmbH)
Transcribe! 8.40 (HKLM-x32\...\Transcribe!_is1) (Version: 8.40 - Seventh String Software)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VMLite Workstation (HKLM\...\{197F2BEF-2705-406E-8CEB-8E404FFFE414}) (Version: 3.2.6 - VMLite)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{4F9EFA88-960A-41FA-B56C-FE993D861FA6}) (Version: 21.00.8480 - Buhl Data Service GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

24-01-2015 00:00:04 Removed Shark007 Advanced Codecs.
26-01-2015 23:28:31 Revo Uninstaller's restore point - Google Chrome

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {161E825F-E2AA-4175-BC1F-4D03F9100354} - System32\Tasks\{ABD1FC5D-F115-4312-B835-5F72B0F06AF4} => pcalua.exe -a "C:\Users\Gregor\Downloads\4200fvst648620a_64de (1).exe" -d C:\Users\Gregor\Downloads
Task: {1A375487-EF08-4A15-8F70-1A4A42A70C3C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {65F6351A-53F5-4D3A-81FE-040849D8678E} - System32\Tasks\FreeFixer background scan => C:\Program Files\FreeFixer\freefixer.exe [2014-09-16] (Kephyr)
Task: {74650E97-E9EB-4BB7-9433-4ED6150CAFBD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {7A45A7A8-4288-490C-8299-A7F713F83303} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {8313ECDA-A864-4051-999F-CAF2FFE9D945} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)
Task: {8B87EC0D-B85A-44B1-92CD-A450FAF8E1C2} - System32\Tasks\{719118DA-0CB0-4201-9147-FC0A6DF78DC1} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64en.exe -d C:\Users\Gregor\Downloads
Task: {ABA0824B-9509-4D54-8A2A-9ED32C299005} - System32\Tasks\{85AB14EB-242A-4810-BD1C-583A453A67DE} => pcalua.exe -a C:\Users\Gregor\Downloads\USBDrivers_231.exe -d C:\Users\Gregor\Downloads
Task: {B1DF5B7B-A9B2-4C1B-884A-5EEC2C435BDA} - System32\Tasks\{A9C356FA-DEB4-4F61-9E59-27C969DEC297} => pcalua.exe -a E:\Scangear\German\SetupSG.exe -d E:\Scangear\German
Task: {C306D80E-A5E0-4838-B3B3-556019779A6A} - System32\Tasks\{090D3749-44DF-4ED3-80AB-291B6A2A604E} => pcalua.exe -a C:\Users\Gregor\Downloads\4200fvst648620a_64de\SetupSG.exe -d C:\Users\Gregor\Downloads\4200fvst648620a_64de
Task: {DA4DA4DE-58FF-4A28-8213-BD2CE1230BD6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-26] (Google Inc.)
Task: {DAB7D088-1247-4073-A1C7-435025FD8326} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-20] (Microsoft Corporation)
Task: {F73BD0F3-8AE0-4712-A9B3-3AF2DB03D345} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
Task: {FB8EB4B8-159D-4D9F-B06D-366AE7C0A6D4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-26] (Google Inc.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\FreeFixer background scan.job => C:\Program Files\FreeFixer\freefixer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-01-10 17:45 - 2006-06-27 16:28 - 00322048 _____ () C:\WINDOWS\system32\CNQL3203.DLL
2010-08-11 14:18 - 2010-08-11 14:18 - 00202344 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxDDU.dll
2010-08-11 14:18 - 2010-08-11 14:18 - 02725480 _____ () C:\Program Files\VMLite\VMLite Workstation\VBoxRT.dll
2009-03-26 22:03 - 2009-03-26 22:03 - 01289728 _____ () C:\Program Files\VMLite\VMLite Workstation\LIBEAY32.dll
2013-10-07 14:52 - 2013-10-07 14:52 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-22 08:19 - 2013-08-22 07:54 - 00174592 _____ () C:\WINDOWS\system32\WinMetadata\Windows.UI.winmd
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-04-04 18:54 - 2012-04-04 18:54 - 00015360 _____ () C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\SSLSupport.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00438336 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
2014-11-19 22:14 - 2014-11-19 22:14 - 00320064 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
2015-01-24 10:26 - 2015-01-24 10:26 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\c89a3da49bf7bd161745f4228277ea00\PSIClient.ni.dll
2013-12-11 15:01 - 2012-07-18 06:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\All Users:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\ProgramData\Application Data:$SS_DESCRIPTOR_LBP6VPVFLVGVTFB84LTSUTB92PFNPC7BPV4XFJDMNGTFB5V5NBJ5TBBJMT9Y0N96GV6PYM54U3M96HFNXH553Y8VPHKL606FVGEG1P6ERPVRDVT8JL9JJMPYV0PRUEF39P8XHH0TCFUL44FTBX4MLSWPBXRTF6VEKLFEJK35PNX0WHNGT9LSVEVV1VTVVTVMVV7
AlternateDataStreams: C:\Users\Gregor\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "WISO Mein Steuer-Sparbuch heute.lnk"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKLM\...\StartupApproved\Run32: => "OpwareSE2"
HKLM\...\StartupApproved\Run32: => "OPSE reminder"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesPreload"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "KiesAirMessage"
HKU\S-1-5-21-4223944866-4218211989-4134806692-1001\...\StartupApproved\Run: => "Reminder"

========================= Accounts: ==========================

Administrator (S-1-5-21-4223944866-4218211989-4134806692-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-4223944866-4218211989-4134806692-501 - Limited - Disabled)
Gregor (S-1-5-21-4223944866-4218211989-4134806692-1001 - Administrator - Enabled) => C:\Users\Gregor
HomeGroupUser$ (S-1-5-21-4223944866-4218211989-4134806692-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Garmin USB GPS
Description: Garmin USB GPS
Class Guid: {a12a4c5a-e1a3-4151-9927-7f724ca5dc92}
Manufacturer: Garmin
Service: grmnusb
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Netzwerkcontroller
Description: Netzwerkcontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/27/2015 09:39:20 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (01/27/2015 00:31:16 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.


System errors:
=============
Error: (01/27/2015 11:51:44 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}

Error: (01/27/2015 11:51:44 PM) (Source: DCOM) (EventID: 10010) (User: USER-PC)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}


Microsoft Office Sessions:
=========================
Error: (12/31/2014 06:26:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 565 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (08/30/2014 01:19:56 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 0 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-3245 CPU @ 3.40GHz
Percentage of memory in use: 21%
Total physical RAM: 7873.64 MB
Available physical RAM: 6190.95 MB
Total Pagefile: 9089.64 MB
Available Pagefile: 7251.33 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (SYSTEM) (Fixed) (Total:111.45 GB) (Free:62.66 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:465.76 GB) (Free:465.11 GB) NTFS
Drive f: (Festplatte) (Fixed) (Total:698.64 GB) (Free:565.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 7CA3E6EF)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 698.6 GB) (Disk ID: BF66C29B)
Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 7CA3E6FA)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 29.01.2015, 12:03

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

amigo54 · 29.01.2015, 23:33

Hallo,

vielen Dank für die schnelle und kompetente Hilfe!

Wie es aussieht, wurde das Problem gelöst ;-)

Nochmals vielen Dank!
Viele Grüße

26.01.2015, 11:28	#6
schrauber /// the machine /// TB-Ausbilder	Chrome öffnet automatisch neue Tabs Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de __________________ --> Chrome öffnet automatisch neue Tabs

27.01.2015, 11:43	#8
schrauber /// the machine /// TB-Ausbilder	Chrome öffnet automatisch neue Tabs Etwas verwirrend der Text Chrome wurde wieder neu installiert und dann zurückgesetzt? und immer noch probleme in Chrome? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

28.01.2015, 10:56	#10
schrauber /// the machine /// TB-Ausbilder	Chrome öffnet automatisch neue Tabs Ok, vorab: Verbindest Du Chrome mit einem Google Konto? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Chrome öffnet automatisch neue Tabs

Log-Analyse und Auswertung: Chrome öffnet automatisch neue Tabs