"search protect" in taskleiste (windows7)

<?xml version="1.0" encoding="UTF-16"?>
@namespace html url(hxxp://www.w3.org/1999/xhtml); :root {                       font:small Verdana;        font-weight: bold;         padding: 2em;              padding-left:4em;       }                          * {                           display: block;            padding-left: 2em;      }                          html|style {                  display: none;          }                          html|span, html|a {           display: inline;           padding: 0;                font-weight: normal;       text-decoration: none;  }                          html|span.block {             display: block;         }                          *[html|hidden],            span.block[html|hidden] {     display: none;          }                          .expand {                     display: block;         }                          .expand:before {              content: '+';              color: red;                position: absolute;        left: -1em;             }  .collapse {                   display: block;         }                          .collapse:before {            content: '-';              color: red;                position: absolute;        left:-1em;              }                         
<mbam-log>


<header>

<date>2015/01/27 21:58:04 +0100</date>

<logfile>mbam-log-2015-01-27 (21-58-03).xml</logfile>

<isadmin>yes</isadmin>

</header>


<engine>

<version>2.00.4.1028</version>

<malware-database>v2015.01.27.09</malware-database>

<rootkit-database>v2015.01.14.01</rootkit-database>

<license>free</license>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


<system>

<osversion>Windows 7 Service Pack 1</osversion>

<arch>x64</arch>

<username>User</username>

<filesys>NTFS</filesys>

</system>


<summary>

<type>threat</type>

<result>completed</result>

<objects>522137</objects>

<time>383</time>

<processes>4</processes>

<modules>9</modules>

<keys>10</keys>

<values>3</values>

<datas>8</datas>

<folders>37</folders>

<files>79</files>

<sectors>0</sectors>

</summary>


<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>


<items>


<process>

<path>C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe</path>

<vendor>PUP.Optional.WindowsProtectManger.A</vendor>

<action>delete-on-reboot</action>

<pid>1368</pid>

<hash>085dc7355336f442936805c14fb2e31d</hash>

</process>


<process>

<path>C:\Program Files (x86)\XTab\ProtectService.exe</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<pid>1740</pid>

<hash>a4c159a33851d95d829375931be75fa1</hash>

</process>


<process>

<path>C:\Program Files (x86)\XTab\CmdShell.exe</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<pid>2188</pid>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</process>


<process>

<path>C:\Program Files (x86)\XTab\HPNotify.exe</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<pid>3352</pid>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</process>


<module>

<path>C:\Program Files (x86)\XTab\BrowerWatchFF.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\BrowserAction.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\IeWatchDog.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\msvcp110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\msvcp110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\msvcp110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\msvcr110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\msvcr110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<module>

<path>C:\Program Files (x86)\XTab\msvcr110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</module>


<key>

<path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect</path>

<vendor>PUP.Optional.WindowsProtectManger.A</vendor>

<action>success</action>

<hash>085dc7355336f442936805c14fb2e31d</hash>

</key>


<key>

<path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>a4c159a33851d95d829375931be75fa1</hash>

</key>


<key>

<path>HKLM\SOFTWARE\MICROSOFT\INTERNET 
EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}</path>

<vendor>PUP.Optional.Qone8</vendor>

<action>success</action>

<hash>66ff58a4b8d1b6808120a63d7d87fa06</hash>

</key>


<key>

<path>HKLM\SOFTWARE\WOW6432NODE\IHProtect</path>

<vendor>PUP.Optional.IHProtect.A</vendor>

<action>success</action>

<hash>1a4be616f7926dc98288fc81739019e7</hash>

</key>


<key>

<path>HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect</path>

<vendor>PUP.Optional.WPM.A</vendor>

<action>success</action>

<hash>c89d00fc6e1b71c543af8d6a63a143bd</hash>

</key>


<key>

<path>HKLM\SOFTWARE\WOW6432NODE\webssearchesSoftware</path>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>success</action>

<hash>94d19f5d5435fe3849704174f310d030</hash>

</key>


<key>

<path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET 
EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}</path>

<vendor>PUP.Optional.Qone8</vendor>

<action>success</action>

<hash>e77e708cdfaaa78f7c25984b33d14fb1</hash>

</key>


<key>

<path>HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect</path>

<vendor>PUP.Optional.WindowsMangerProtect.A</vendor>

<action>success</action>

<hash>62038775e4a584b233e12b5d8e7529d7</hash>

</key>


<key>

<path>HKU\S-1-5-21-4093833643-2685545966-1431014470-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET6
EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}</path>

<vendor>PUP.Optional.Qone8</vendor>

<action>success</action>

<hash>e1843ac29dec69cddbc5e10259ab2ed2</hash>

</key>


<key>

<path>HKU\S-1-5-21-4093833643-2685545966-1431014470-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS</path>

<vendor>PUP.Optional.FastStart.A</vendor>

<action>success</action>

<hash>ff6636c6a6e3bd7913eadbb4946f52ae</hash>

</key>


<value>

<path>HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS</path>

<valuename>fftoolbar2014@etech.com</valuename>

<vendor>PUP.Optional.FFToolbar.A</vendor>

<action>success</action>

<valuedata>C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bu6wo346.default\extensions\fftoolbar2014@etech.com</valuedata>

<hash>5e0714e8b8d168ce564e6f0df50ee31d</hash>

</value>


<value>

<path>HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS</path>

<valuename>faststartff@gmail.com</valuename>

<vendor>PUP.Optional.FastStart.A</vendor>

<action>success</action>

<valuedata>C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bu6wo346.default\extensions\faststartff@gmail.com</valuedata>

<hash>78ed42ba10792e089775b44312f245bb</hash>

</value>


<value>

<path>HKU\S-1-5-21-4093833643-2685545966-1431014470-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS</path>

<valuename>appid</valuename>

<vendor>PUP.Optional.FastStart.A</vendor>

<action>success</action>

<valuedata>faststartff@gmail.com</valuedata>

<hash>ff6636c6a6e3bd7913eadbb4946f52ae</hash>

</value>


<data>

<path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path>

<valuename>Start Page</valuename>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>replaced</action>

<valuedata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</valuedata>

<baddata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</baddata>

<gooddata>www.google.com</gooddata>

<hash>bfa68f6ded9cc1753b93465756af05fb</hash>

</data>


<data>

<path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path>

<valuename>DefaultScope</valuename>

<vendor>PUP.Optional.Qone8</vendor>

<action>replaced</action>

<valuedata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</valuedata>

<baddata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</baddata>

<gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata>

<hash>164fe418ee9b082e7f2c6740a16415eb</hash>

</data>


<data>

<path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN</path>

<valuename>Default_Search_URL</valuename>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>replaced</action>

<valuedata>hxxp://istart.webssearches.com/web/?type=ds&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215&q={searchTerms}</valuedata>

<baddata>hxxp://istart.webssearches.com/web/?type=ds&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215&q={searchTerms}</baddata>

<gooddata>www.google.com</gooddata>

<hash>7ee741bb3e4bed49c4096a3307fe3bc5</hash>

</data>


<data>

<path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN</path>

<valuename>Default_Page_URL</valuename>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>replaced</action>

<valuedata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</valuedata>

<baddata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</baddata>

<gooddata>www.google.com</gooddata>

<hash>2144a6563b4ea096f8d4d3cac73e3fc1</hash>

</data>


<data>

<path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN</path>

<valuename>Start Page</valuename>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>replaced</action>

<valuedata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</valuedata>

<baddata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</baddata>

<gooddata>www.google.com</gooddata>

<hash>3d28e11b49405adcefdf2b7226df6b95</hash>

</data>


<data>

<path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN</path>

<valuename>Search Page</valuename>

<vendor>PUP.Optional.WebsSearches</vendor>

<action>replaced</action>

<valuedata>hxxp://istart.webssearches.com/web/?type=ds&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215&q={searchTerms}</valuedata>

<baddata>hxxp://istart.webssearches.com/web/?type=ds&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215&q={searchTerms}</baddata>

<gooddata>www.google.com</gooddata>

<hash>1e47f903d9b03bfbb492adee0ff6e31d</hash>

</data>


<data>

<path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path>

<valuename>DefaultScope</valuename>

<vendor>PUP.Optional.Qone8</vendor>

<action>replaced</action>

<valuedata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</valuedata>

<baddata>{33BB0A4E-99AF-4226-BDF6-49120163DE86}</baddata>

<gooddata>{0633EE93-D776-472f-A0FF-E1416B8B2E3A}</gooddata>

<hash>c5a0de1ee8a13ef82982a5021ee7d927</hash>

</data>


<data>

<path>HKU\S-1-5-21-4093833643-2685545966-1431014470-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNETl
EXPLORER\MAIN</path>

<valuename>Start Page</valuename>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>replaced</action>

<valuedata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</valuedata>

<baddata>hxxp://istart.webssearches.com/?type=hp&ts=1421270582&from=cvs&uid=WDCXWD3200KS-75PFB0_WD-WCAPD333321533215</baddata>

<gooddata>www.google.com</gooddata>

<hash>fd6813e935549a9ccb9e495ff60f31cf</hash>

</data>


<folder>

<path>C:\Program Files (x86)\XTab</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\skin</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\skin\image</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\img</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\img\weather</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\en-US</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\es-419</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\es-ES</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-BE</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-CA</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-CH</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-FR</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-LU</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\it-CH</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\it-IT</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\pl</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\pt</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\pt-BR</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\ru</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\ru-MO</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\tr-TR</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\vi-VI</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\zh-CN</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\XTab\web\_locales\zh-TW</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</folder>


<folder>

<path>C:\Users\User\AppData\Roaming\webssearches</path>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>success</action>

<hash>a8bdca3290f9a98d72103e0a4fb48d73</hash>

</folder>


<folder>

<path>C:\Users\User\AppData\Roaming\webssearches\log</path>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>success</action>

<hash>a8bdca3290f9a98d72103e0a4fb48d73</hash>

</folder>


<folder>

<path>C:\Users\User\AppData\Local\SearchProtect</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>501549b331583afc78f188cf020104fc</hash>

</folder>


<folder>

<path>C:\Users\User\AppData\Local\SearchProtect\Logs</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>501549b331583afc78f188cf020104fc</hash>

</folder>


<folder>

<path>C:\ProgramData\WindowsMangerProtect</path>

<vendor>PUP.Optional.WPM.A</vendor>

<action>delete-on-reboot</action>

<hash>a3c200fc563337fffcc7d58491726d93</hash>

</folder>


<folder>

<path>C:\ProgramData\WindowsMangerProtect\update</path>

<vendor>PUP.Optional.WPM.A</vendor>

<action>success</action>

<hash>a3c200fc563337fffcc7d58491726d93</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\SearchProtect\Main</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>1a4b7f7d0e7b3204f1bb83f22ad919e7</hash>

</folder>


<folder>

<path>C:\Program Files (x86)\SearchProtect\Main\rep</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>1a4b7f7d0e7b3204f1bb83f22ad919e7</hash>

</folder>


<folder>

<path>C:\ProgramData\IHProtectUpDate</path>

<vendor>PUP.Optional.IHProtectUpDate.A</vendor>

<action>success</action>

<hash>164fd3292f5a15218c947403d132659b</hash>

</folder>


<folder>

<path>C:\ProgramData\IHProtectUpDate\update</path>

<vendor>PUP.Optional.IHProtectUpDate.A</vendor>

<action>success</action>

<hash>164fd3292f5a15218c947403d132659b</hash>

</folder>


<file>

<path>C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe</path>

<vendor>PUP.Optional.WindowsProtectManger.A</vendor>

<action>delete-on-reboot</action>

<hash>085dc7355336f442936805c14fb2e31d</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\ProtectService.exe</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>a4c159a33851d95d829375931be75fa1</hash>

</file>


<file>

<path>C:\Users\Gast\Downloads\PhotoScape_V3.6.5.exe</path>

<vendor>PUP.Optional.OpenCandy</vendor>

<action>success</action>

<hash>3c292cd0ee9ba393f5ff903df213c739</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\uninstall.exe</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\BrowerWatchCH.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\BrowerWatchFF.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\BrowserAction.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\CmdShell.exe</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\conf</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\HPNotify.exe</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\IeWatchDog.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\msvcp110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\msvcr110.dll</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>delete-on-reboot</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\about.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\about_bk.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\btn.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\btn_apply.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\close.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\conf.xml</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\conf_back.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\input_bk.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\logo.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\main.xml</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\radio_1.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\radio_2.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\rigth_arrow.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\skin\settings.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\data.html</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\indexIE.html</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\indexIE8.html</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\main.css</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\ver.txt</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\arrow.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\default_add_logo.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\default_add_logo_hover.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\default_logo.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\googlelogo.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\googlelogo2.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\google_trends.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\icon128.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\icon16.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\icon48.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\loading.gif</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\logo32.ico</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\img\weather\0.png</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\common.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\ga.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\ie8.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\jquery-1.11.0.min.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\jquery.autocomplete.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\js.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\library.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\xagainit-ie8.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\xagainit.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\js\xagainit2.0.js</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\en-US\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\es-419\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\es-ES\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-BE\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-CA\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-CH\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-FR\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\fr-LU\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\it-CH\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\it-IT\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\pl\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\pt\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\pt-BR\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\ru\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\ru-MO\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\tr-TR\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\vi-VI\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\zh-CN\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Program Files (x86)\XTab\web\_locales\zh-TW\messages.json</path>

<vendor>PUP.Optional.XTab.A</vendor>

<action>success</action>

<hash>bea70defa7e277bf2edd6c1115eee719</hash>

</file>


<file>

<path>C:\Users\User\AppData\Roaming\webssearches\UninstallManager.exe</path>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>success</action>

<hash>a8bdca3290f9a98d72103e0a4fb48d73</hash>

</file>


<file>

<path>C:\Users\User\AppData\Roaming\webssearches\log\UninstallManager_2015-01-17[20-59-07-050].log</path>

<vendor>PUP.Optional.WebsSearches.A</vendor>

<action>success</action>

<hash>a8bdca3290f9a98d72103e0a4fb48d73</hash>

</file>


<file>

<path>C:\ProgramData\WindowsMangerProtect\update\conf</path>

<vendor>PUP.Optional.WPM.A</vendor>

<action>success</action>

<hash>a3c200fc563337fffcc7d58491726d93</hash>

</file>


<file>

<path>C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>1a4b7f7d0e7b3204f1bb83f22ad919e7</hash>

</file>


<file>

<path>C:\ProgramData\IHProtectUpDate\update\conf</path>

<vendor>PUP.Optional.IHProtectUpDate.A</vendor>

<action>success</action>

<hash>164fd3292f5a15218c947403d132659b</hash>

</file>

</items>

</mbam-log>
         

# AdwCleaner v4.109 - Bericht erstellt am 27/01/2015 um 22:18:45
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-01-26.1 [Live]
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : User - USER-PC
# Gestartet von : C:\Users\User\Desktop\AdwCleaner_4.109.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\SearchProtect
Ordner Gelöscht : C:\Users\User\AppData\Roaming\pdfforge
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\wbexjcvf.default-1421527888779\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v35.0.1 (x86 de)


*************************

AdwCleaner[R0].txt - [1157 octets] - [27/01/2015 22:16:46]
AdwCleaner[S0].txt - [1032 octets] - [27/01/2015 22:18:45]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1092 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Professional x64
Ran by User on 27.01.2015 at 22:23:02,65
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.01.2015 at 22:25:50,35
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by User (administrator) on USER-PC on 27-01-2015 22:28:29
Running from C:\Users\Ingo\Downloads\Trojaner\FRST
Loaded Profiles: User (Available profiles: User & Ingo & Uli & Jasper & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(MICRO-STAR INTERNATIONAL CO., LTD.) C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_296.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7016520 2013-02-05] (Realtek Semiconductor)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4093833643-2685545966-1431014470-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ?type=hppp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = web/?type=dspp&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4093833643-2685545966-1431014470-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\wbexjcvf.default-1421527888779
FF SelectedSearchEngine: 
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-25]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-25] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-25] (Avast Software)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [149032 2012-08-16] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165336 2013-01-14] (Intel Corporation)
R2 MSI_Trigger_Service; C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe [30240 2013-03-20] (MICRO-STAR INTERNATIONAL CO., LTD.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-25] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-25] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-25] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-25] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-25] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-25] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-25] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-25] ()
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [20968 2012-08-16] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [19944 2012-08-16] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46016 2012-08-16] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-27] (Malwarebytes Corporation)
S3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [108112 2014-02-28] (NCP Engineering GmbH)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-25] (Avast Software)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2015-01-27] ()
S3 MSICDSetup; \??\E:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 22:25 - 2015-01-27 22:25 - 00000624 _____ () C:\Users\User\Desktop\JRT.txt
2015-01-27 22:23 - 2015-01-27 22:23 - 00000000 ____D () C:\Windows\ERUNT
2015-01-27 22:22 - 2015-01-27 22:22 - 00000197 _____ () C:\Windows\system32\2015-01-27-21-22-14.074-AvastVBoxSVC.exe-2892.log
2015-01-27 22:20 - 2015-01-27 22:20 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2015-01-27 22:20 - 2015-01-27 22:20 - 00001172 _____ () C:\Users\User\Desktop\AdwCleaner[S0].txt
2015-01-27 22:16 - 2015-01-27 22:18 - 00000000 ____D () C:\AdwCleaner
2015-01-27 22:09 - 2015-01-27 22:09 - 00000197 _____ () C:\Windows\system32\2015-01-27-21-09-38.028-AvastVBoxSVC.exe-2944.log
2015-01-27 21:59 - 2015-01-27 21:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-27 21:57 - 2015-01-27 22:08 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-27 21:56 - 2015-01-27 21:56 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-27 21:56 - 2015-01-27 21:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-27 21:56 - 2015-01-27 21:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-27 21:56 - 2015-01-27 21:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-01-27 21:56 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-27 21:56 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-27 21:56 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-27 21:53 - 2015-01-27 21:53 - 01707939 _____ (Thisisu) C:\Users\User\Desktop\JRT.exe
2015-01-27 21:51 - 2015-01-27 21:51 - 02194432 _____ () C:\Users\User\Desktop\AdwCleaner_4.109.exe
2015-01-27 21:44 - 2015-01-27 21:44 - 00000197 _____ () C:\Windows\system32\2015-01-27-20-44-26.002-AvastVBoxSVC.exe-3604.log
2015-01-27 10:30 - 2015-01-27 10:31 - 00000197 _____ () C:\Windows\system32\2015-01-27-09-30-56.094-AvastVBoxSVC.exe-3084.log
2015-01-26 21:42 - 2015-01-26 21:42 - 00000016 ____H () C:\Users\Ingo\AppData\Roaming\SyncToy_d1262dcf-adf4-4b92-b3cd-82746d79f8af.dat
2015-01-26 21:29 - 2015-01-26 21:29 - 00000197 _____ () C:\Windows\system32\2015-01-26-20-29-06.097-AvastVBoxSVC.exe-3540.log
2015-01-26 21:05 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-26 21:05 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-26 21:05 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-26 21:05 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-26 21:05 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-26 21:05 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-26 21:05 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-26 21:05 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-26 21:04 - 2015-01-26 21:17 - 00000000 ____D () C:\Qoobox
2015-01-26 21:04 - 2015-01-26 21:15 - 00000000 ____D () C:\Windows\erdnt
2015-01-26 20:54 - 2015-01-26 20:54 - 00000197 _____ () C:\Windows\system32\2015-01-26-19-54-21.090-AvastVBoxSVC.exe-2128.log
2015-01-25 23:39 - 2015-01-25 23:39 - 00002585 _____ () C:\Users\Ingo\Desktop\SyncToy 2.1(x64).lnk
2015-01-25 19:46 - 2015-01-25 19:46 - 00000197 _____ () C:\Windows\system32\2015-01-25-18-46-23.085-AvastVBoxSVC.exe-2600.log
2015-01-25 16:16 - 2015-01-25 16:17 - 00000197 _____ () C:\Windows\system32\2015-01-25-15-16-48.005-AvastVBoxSVC.exe-2700.log
2015-01-25 13:44 - 2015-01-25 13:44 - 00000197 _____ () C:\Windows\system32\2015-01-25-12-44-15.072-AvastVBoxSVC.exe-3160.log
2015-01-25 13:08 - 2015-01-27 22:28 - 00000000 ____D () C:\FRST
2015-01-25 13:03 - 2015-01-25 13:03 - 00000000 _____ () C:\Users\User\defogger_reenable
2015-01-25 12:56 - 2015-01-27 21:53 - 00000000 ____D () C:\Users\Ingo\Downloads\Trojaner
2015-01-25 12:04 - 2015-01-25 12:04 - 00000197 _____ () C:\Windows\system32\2015-01-25-11-04-23.070-AvastVBoxSVC.exe-2600.log
2015-01-24 19:33 - 2015-01-24 19:33 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-24 19:33 - 2015-01-24 19:33 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-24 19:14 - 2015-01-24 19:14 - 00000197 _____ () C:\Windows\system32\2015-01-24-18-14-04.000-AvastVBoxSVC.exe-3456.log
2015-01-23 19:10 - 2015-01-23 19:11 - 00000197 _____ () C:\Windows\system32\2015-01-23-18-10-41.027-AvastVBoxSVC.exe-3316.log
2015-01-21 22:37 - 2015-01-21 22:37 - 00000197 _____ () C:\Windows\system32\2015-01-21-21-37-43.005-AvastVBoxSVC.exe-3388.log
2015-01-21 20:57 - 2015-01-21 20:57 - 00000197 _____ () C:\Windows\system32\2015-01-21-19-57-22.037-AvastVBoxSVC.exe-2816.log
2015-01-21 19:17 - 2015-01-21 19:18 - 00000197 _____ () C:\Windows\system32\2015-01-21-18-17-45.071-AvastVBoxSVC.exe-2500.log
2015-01-21 16:28 - 2015-01-21 16:28 - 00000104 _____ () C:\Users\Uli\Desktop\Standardprogramme - Verknüpfung.lnk
2015-01-21 14:58 - 2015-01-21 14:58 - 00000197 _____ () C:\Windows\system32\2015-01-21-13-58-02.040-AvastVBoxSVC.exe-2740.log
2015-01-20 22:45 - 2015-01-20 22:45 - 00000197 _____ () C:\Windows\system32\2015-01-20-21-45-20.061-AvastVBoxSVC.exe-2184.log
2015-01-20 07:59 - 2015-01-20 07:59 - 00000197 _____ () C:\Windows\system32\2015-01-20-06-59-17.033-AvastVBoxSVC.exe-2152.log
2015-01-18 21:09 - 2015-01-18 21:58 - 00002585 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SyncToy 2.1(x64).lnk
2015-01-18 21:09 - 2015-01-18 21:09 - 00000000 ____D () C:\Program Files\SyncToy 2.1
2015-01-18 21:01 - 2015-01-18 21:01 - 00000000 ____D () C:\Program Files\Microsoft Sync Framework
2015-01-18 21:00 - 2015-01-18 21:00 - 00000000 ____D () C:\Users\Ingo\Downloads\synctoy
2015-01-18 20:18 - 2015-01-18 20:18 - 00000197 _____ () C:\Windows\system32\2015-01-18-19-18-05.063-AvastVBoxSVC.exe-3008.log
2015-01-18 00:11 - 2015-01-18 00:11 - 00000197 _____ () C:\Windows\system32\2015-01-17-23-11-15.012-AvastVBoxSVC.exe-2960.log
2015-01-18 00:04 - 2015-01-18 00:05 - 00000197 _____ () C:\Windows\system32\2015-01-17-23-04-50.009-AvastVBoxSVC.exe-2800.log
2015-01-17 22:28 - 2015-01-17 22:29 - 00000000 ____D () C:\Users\User\Documents\WD-externe Festplatte
2015-01-17 22:08 - 2015-01-27 11:55 - 00000072 _____ () C:\Users\Public\LMDebug.log
2015-01-17 21:51 - 2015-01-17 21:51 - 00000000 ____D () C:\Users\User\Desktop\Alte Firefox-Daten
2015-01-17 21:40 - 2015-01-17 21:40 - 00000000 ____D () C:\ProgramData\Samsung
2015-01-17 21:40 - 2015-01-17 21:40 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate
2015-01-17 20:41 - 2015-01-17 22:28 - 00000000 ____D () C:\Users\User\Documents\Samsung Drucker
2015-01-17 20:38 - 2015-01-17 20:38 - 00000000 ____D () C:\Users\User\AppData\Roaming\WinRAR
2015-01-17 20:37 - 2015-01-17 20:37 - 00000197 _____ () C:\Windows\system32\2015-01-17-19-37-02.038-AvastVBoxSVC.exe-2292.log
2015-01-17 16:08 - 2015-01-17 16:09 - 00000197 _____ () C:\Windows\system32\2015-01-17-15-08-40.097-AvastVBoxSVC.exe-3516.log
2015-01-17 11:57 - 2015-01-17 11:57 - 00000197 _____ () C:\Windows\system32\2015-01-17-10-57-07.081-AvastVBoxSVC.exe-2824.log
2015-01-15 22:19 - 2015-01-15 22:19 - 00000197 _____ () C:\Windows\system32\2015-01-15-21-19-11.037-AvastVBoxSVC.exe-2624.log
2015-01-14 22:28 - 2015-01-14 22:28 - 00000000 ____D () C:\Users\User\AppData\Roaming\DVDVideoSoft
2015-01-14 22:06 - 2015-01-14 22:06 - 00000197 _____ () C:\Windows\system32\2015-01-14-21-06-22.018-AvastVBoxSVC.exe-2756.log
2015-01-14 18:34 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 18:34 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 18:34 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 18:34 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 18:34 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 18:34 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 18:34 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 18:34 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 18:34 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 18:34 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 18:34 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 18:34 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 18:34 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 18:27 - 2015-01-14 18:28 - 00000197 _____ () C:\Windows\system32\2015-01-14-17-27-55.085-AvastVBoxSVC.exe-2696.log
2015-01-14 09:09 - 2015-01-14 09:09 - 00000197 _____ () C:\Windows\system32\2015-01-14-08-09-04.004-AvastVBoxSVC.exe-2500.log
2015-01-13 22:50 - 2015-01-13 22:50 - 00000197 _____ () C:\Windows\system32\2015-01-13-21-50-26.086-AvastVBoxSVC.exe-3156.log
2015-01-13 18:46 - 2015-01-13 18:46 - 00000197 _____ () C:\Windows\system32\2015-01-13-17-46-28.031-AvastVBoxSVC.exe-3160.log
2015-01-13 08:37 - 2015-01-13 08:38 - 00000197 _____ () C:\Windows\system32\2015-01-13-07-37-42.022-AvastVBoxSVC.exe-2568.log
2015-01-12 19:56 - 2015-01-12 19:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FILEminimizer Pictures 3.0
2015-01-12 19:55 - 2015-01-12 19:55 - 00000000 __SHD () C:\Users\User\AppData\Local\EmieBrowserModeList
2015-01-12 19:53 - 2015-01-12 19:53 - 00000000 ____D () C:\Users\Ingo\Downloads\fileminimizer
2015-01-12 19:37 - 2015-01-12 19:37 - 00000197 _____ () C:\Windows\system32\2015-01-12-18-37-27.086-AvastVBoxSVC.exe-3004.log
2015-01-11 19:57 - 2015-01-11 19:57 - 00000197 _____ () C:\Windows\system32\2015-01-11-18-57-35.073-AvastVBoxSVC.exe-2868.log
2015-01-11 17:47 - 2015-01-11 17:48 - 00000197 _____ () C:\Windows\system32\2015-01-11-16-47-28.073-AvastVBoxSVC.exe-2824.log
2015-01-11 14:04 - 2015-01-11 14:05 - 00000197 _____ () C:\Windows\system32\2015-01-11-13-04-47.086-AvastVBoxSVC.exe-2696.log
2015-01-11 09:08 - 2015-01-11 09:09 - 00000197 _____ () C:\Windows\system32\2015-01-11-08-08-54.087-AvastVBoxSVC.exe-2684.log
2015-01-10 14:57 - 2015-01-10 14:57 - 00000197 _____ () C:\Windows\system32\2015-01-10-13-57-15.094-AvastVBoxSVC.exe-3624.log
2015-01-10 12:19 - 2015-01-10 12:20 - 00000197 _____ () C:\Windows\system32\2015-01-10-11-19-33.040-AvastVBoxSVC.exe-2964.log
2015-01-09 18:21 - 2015-01-09 18:21 - 00000197 _____ () C:\Windows\system32\2015-01-09-17-21-21.072-AvastVBoxSVC.exe-2756.log
2015-01-08 20:27 - 2015-01-08 20:27 - 00000197 _____ () C:\Windows\system32\2015-01-08-19-27-29.012-AvastVBoxSVC.exe-2888.log
2015-01-08 18:04 - 2015-01-08 18:04 - 00000197 _____ () C:\Windows\system32\2015-01-08-17-04-41.062-AvastVBoxSVC.exe-1268.log
2015-01-08 10:43 - 2015-01-08 10:44 - 00000197 _____ () C:\Windows\system32\2015-01-08-09-43-59.017-AvastVBoxSVC.exe-2660.log
2015-01-08 08:08 - 2015-01-08 08:08 - 00000197 _____ () C:\Windows\system32\2015-01-08-07-08-20.073-AvastVBoxSVC.exe-2616.log
2015-01-08 07:46 - 2015-01-08 07:46 - 00000197 _____ () C:\Windows\system32\2015-01-08-06-46-35.082-AvastVBoxSVC.exe-2808.log
2015-01-07 23:01 - 2015-01-07 23:01 - 00000197 _____ () C:\Windows\system32\2015-01-07-22-01-08.065-AvastVBoxSVC.exe-2352.log
2015-01-07 19:40 - 2015-01-07 19:40 - 00000197 _____ () C:\Windows\system32\2015-01-07-18-40-18.075-AvastVBoxSVC.exe-2676.log
2015-01-07 18:13 - 2015-01-07 18:14 - 00000197 _____ () C:\Windows\system32\2015-01-07-17-13-28.063-AvastVBoxSVC.exe-3388.log
2015-01-07 06:51 - 2015-01-07 06:51 - 00000197 _____ () C:\Windows\system32\2015-01-07-05-51-28.080-AvastVBoxSVC.exe-2812.log
2015-01-06 21:40 - 2015-01-06 21:40 - 00001468 _____ () C:\Users\Public\Desktop\LibreOffice 4.2.lnk
2015-01-06 21:40 - 2015-01-06 21:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2015-01-06 21:24 - 2015-01-06 21:25 - 00000197 _____ () C:\Windows\system32\2015-01-06-20-24-55.053-AvastVBoxSVC.exe-2752.log
2015-01-06 15:11 - 2015-01-06 15:11 - 00000197 _____ () C:\Windows\system32\2015-01-06-14-11-02.090-AvastVBoxSVC.exe-2952.log
2015-01-06 11:53 - 2015-01-06 11:53 - 00000197 _____ () C:\Windows\system32\2015-01-06-10-53-11.073-AvastVBoxSVC.exe-2736.log
2015-01-05 17:58 - 2015-01-05 17:59 - 00000197 _____ () C:\Windows\system32\2015-01-05-16-58-26.031-AvastVBoxSVC.exe-2688.log
2015-01-03 14:18 - 2015-01-03 14:18 - 00000197 _____ () C:\Windows\system32\2015-01-03-13-18-20.086-AvastVBoxSVC.exe-2688.log
2015-01-03 11:08 - 2015-01-03 11:09 - 00000197 _____ () C:\Windows\system32\2015-01-03-10-08-40.082-AvastVBoxSVC.exe-2864.log
2015-01-02 16:41 - 2015-01-02 16:41 - 00000197 _____ () C:\Windows\system32\2015-01-02-15-41-04.089-AvastVBoxSVC.exe-2724.log
2015-01-02 13:49 - 2015-01-02 13:49 - 00000197 _____ () C:\Windows\system32\2015-01-02-12-49-49.015-AvastVBoxSVC.exe-1460.log
2015-01-02 10:51 - 2015-01-02 10:52 - 00000197 _____ () C:\Windows\system32\2015-01-02-09-51-52.063-AvastVBoxSVC.exe-2324.log
2014-12-31 14:03 - 2014-12-31 14:03 - 00000197 _____ () C:\Windows\system32\2014-12-31-13-03-25.051-AvastVBoxSVC.exe-2868.log
2014-12-30 14:27 - 2014-12-30 14:27 - 00000197 _____ () C:\Windows\system32\2014-12-30-13-27-22.006-AvastVBoxSVC.exe-2776.log
2014-12-30 11:26 - 2014-12-30 11:26 - 00000247 _____ () C:\Windows\system32\2014-12-30-10-26-52.005-aswFe.exe-2772.log
2014-12-30 11:20 - 2014-12-30 11:26 - 00000247 _____ () C:\Windows\system32\2014-12-30-10-20-55.030-aswFe.exe-3488.log
2014-12-30 11:20 - 2014-12-30 11:20 - 00000197 _____ () C:\Windows\system32\2014-12-30-10-20-49.080-AvastVBoxSVC.exe-4172.log
2014-12-29 11:55 - 2014-12-29 11:56 - 00000197 _____ () C:\Windows\system32\2014-12-29-10-55-53.057-AvastVBoxSVC.exe-2788.log
2014-12-28 17:16 - 2014-12-28 17:16 - 00000197 _____ () C:\Windows\system32\2014-12-28-16-16-15.095-AvastVBoxSVC.exe-2940.log
2014-12-28 11:04 - 2014-12-28 11:05 - 00000197 _____ () C:\Windows\system32\2014-12-28-10-04-54.042-AvastVBoxSVC.exe-1292.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 22:27 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-27 22:27 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-27 22:26 - 2011-04-12 08:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-01-27 22:26 - 2011-04-12 08:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-01-27 22:26 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-27 22:23 - 2013-11-15 17:00 - 01209295 _____ () C:\Windows\WindowsUpdate.log
2015-01-27 22:20 - 2013-11-15 17:10 - 00034752 _____ () C:\Windows\system32\Drivers\WPRO_41_2001.sys
2015-01-27 22:19 - 2013-02-09 19:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 22:19 - 2010-11-21 04:47 - 00412572 _____ () C:\Windows\PFRO.log
2015-01-27 22:19 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-27 22:19 - 2009-07-14 05:51 - 00105448 _____ () C:\Windows\setupact.log
2015-01-27 22:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas
2015-01-27 22:06 - 2014-10-29 16:37 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2015-01-27 21:55 - 2013-02-09 22:29 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-26 21:40 - 2014-01-29 22:39 - 00000000 ____D () C:\Users\Ingo\AppData\Roaming\MyPhoneExplorer
2015-01-26 21:40 - 2014-01-26 13:23 - 00000000 ____D () C:\Users\Ingo\AppData\Roaming\Thunderbird
2015-01-26 21:40 - 2014-01-26 13:23 - 00000000 ____D () C:\Users\Ingo\AppData\Roaming\Mozilla
2015-01-26 21:26 - 2014-01-25 18:31 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-26 21:17 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-01-26 21:14 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-25 14:36 - 2013-02-09 22:29 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 14:36 - 2013-02-09 22:29 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 14:36 - 2013-02-09 22:29 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 12:46 - 2014-11-09 12:46 - 00000000 ____D () C:\Users\Ingo\Downloads\firefox
2015-01-25 12:46 - 2014-01-28 00:25 - 00000000 ____D () C:\Users\Ingo\Downloads\freecommander
2015-01-25 12:46 - 2014-01-25 18:22 - 00000000 ____D () C:\Users\User\Downloads\freecommander
2015-01-24 19:33 - 2014-10-14 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-24 19:33 - 2014-10-14 18:54 - 00000000 ____D () C:\Program Files\WinRAR
2015-01-18 23:02 - 2014-03-15 23:38 - 00000000 ____D () C:\Users\Ingo\AppData\Roaming\vlc
2015-01-17 22:26 - 2014-12-23 14:46 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe
2015-01-17 22:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-17 21:01 - 2013-11-15 17:01 - 00001425 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-17 21:01 - 2013-02-09 19:42 - 00001169 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-17 21:01 - 2013-02-09 19:42 - 00001157 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-14 22:23 - 2014-01-27 21:16 - 00000000 ____D () C:\Users\Ingo\AppData\Local\CrashDumps
2015-01-14 21:33 - 2013-11-15 17:26 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 21:31 - 2013-02-09 16:51 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 21:30 - 2014-12-04 21:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-12 19:54 - 2013-11-15 17:49 - 00063136 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-11 18:14 - 2014-01-26 13:19 - 00063136 _____ () C:\Users\Ingo\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-11 16:20 - 2014-01-26 19:21 - 00063136 _____ () C:\Users\Uli\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-07 06:49 - 2009-07-14 05:45 - 00292040 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-06 21:40 - 2014-05-08 21:29 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4
2015-01-06 21:36 - 2014-11-09 12:45 - 00000000 ____D () C:\Users\Ingo\Downloads\libreoffice
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-08 11:16

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by User at 2015-01-27 22:28:58
Running from C:\Users\Ingo\Downloads\Trojaner\FRST
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
Audiograbber MP3-Plugin (HKLM-x32\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
FILEminimizer Pictures (HKLM-x32\...\FILEminimizer Pictures_is1) (Version:  - balesio AG)
FreeCommander 2009.02b (HKLM-x32\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.30.1349 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) Smart Connect Technology 3.0 x64 (HKLM\...\{01C324B7-3744-4EC0-9C4F-40BCCDD47CFB}) (Version: 3.0.41.1571 - Intel)
LibreOffice 4.2 Help Pack (German) (HKLM-x32\...\{DA6AF414-24FA-4815-A4FB-5EFD6173E6F5}) (Version: 4.2.4.2 - The Document Foundation)
LibreOffice 4.2.8.2 (HKLM-x32\...\{2D3234B2-FC7B-41CD-9FC8-4F9C2C20C131}) (Version: 4.2.8.2 - The Document Foundation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU  (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
Need for Speed™ Most Wanted (HKLM-x32\...\{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}) (Version:  - )
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6839 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
Texmaker (HKLM-x32\...\Texmaker) (Version:  - )
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

04-11-2014 15:10:11 Windows Update
09-11-2014 11:57:25 Windows Update
09-11-2014 12:42:31 Installed LibreOffice 4.2.6.3
11-11-2014 22:15:15 Windows Update
15-11-2014 16:20:04 Windows Update
19-11-2014 22:37:42 Windows Update
23-11-2014 09:58:27 Windows Update
25-11-2014 22:50:45 avast! antivirus system restore point
29-11-2014 21:28:02 Windows Update
03-12-2014 07:57:01 Windows Update
12-12-2014 15:24:22 Windows Update
12-12-2014 15:51:57 Windows Update
15-12-2014 21:34:42 Windows Update
17-12-2014 22:21:05 Windows Update
23-12-2014 11:13:09 Windows Update
26-12-2014 12:58:26 Windows Update
30-12-2014 11:20:11 Windows Update
06-01-2015 11:57:03 Windows Update
06-01-2015 21:37:53 Installed LibreOffice 4.2.8.2
09-01-2015 18:25:32 Windows Update
13-01-2015 22:51:44 Windows Update
14-01-2015 21:31:30 Windows Update
18-01-2015 21:09:37 Installed SyncToy 2.1 (x64)
20-01-2015 08:03:26 Windows Update
23-01-2015 19:15:58 Windows Update
26-01-2015 21:05:05 ComboFix created restore point
27-01-2015 21:46:38 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {64D1FB2A-375B-4335-9759-733AFF4700C6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {68493A76-FF86-473B-8C96-CB0F9B32A31E} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-25] (AVAST Software)
Task: {E3422092-5FD1-40D9-9E33-C08392C38D6C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-07-31 22:50 - 2014-07-31 22:50 - 00034304 _____ () C:\Windows\System32\sst7clm.dll
2012-08-16 20:36 - 2012-08-16 20:36 - 00149032 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2012-08-16 20:36 - 2012-08-16 20:36 - 00058920 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2014-11-25 22:51 - 2014-11-25 22:51 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-11-25 22:51 - 2014-11-25 22:51 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2013-11-15 17:05 - 2012-09-28 19:51 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2015-01-27 21:52 - 2015-01-27 21:52 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15012701\algo.dll
2014-11-25 22:51 - 2014-11-25 22:51 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2014-11-25 22:51 - 2014-11-25 22:51 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-11-15 17:08 - 2013-01-14 19:25 - 01200088 ____R () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-01-27 21:59 - 2015-01-27 21:59 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2015-01-25 14:36 - 2015-01-25 14:36 - 16844976 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-4093833643-2685545966-1431014470-500 - Administrator - Disabled)
Gast (S-1-5-21-4093833643-2685545966-1431014470-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-4093833643-2685545966-1431014470-1002 - Limited - Enabled)
Ingo (S-1-5-21-4093833643-2685545966-1431014470-1003 - Limited - Enabled) => C:\Users\Ingo
Jasper (S-1-5-21-4093833643-2685545966-1431014470-1006 - Limited - Enabled) => C:\Users\Jasper
Uli (S-1-5-21-4093833643-2685545966-1431014470-1004 - Limited - Enabled) => C:\Users\Uli
User (S-1-5-21-4093833643-2685545966-1431014470-1000 - Administrator - Enabled) => C:\Users\User

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3330 CPU @ 3.00GHz
Percentage of memory in use: 22%
Total physical RAM: 8076.35 MB
Available physical RAM: 6246.22 MB
Total Pagefile: 16150.89 MB
Available Pagefile: 14208.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:200 GB) (Free:78.78 GB) NTFS
Drive d: (Data) (Fixed) (Total:1662.92 GB) (Free:1577.08 GB) NTFS
Drive f: () (Fixed) (Total:194.5 GB) (Free:118.05 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 79751EB5)
Partition 1: (Not Active) - (Size=63 MB) - (Type=DE)
Partition 2: (Active) - (Size=194.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=4.6 GB) - (Type=DB)
Partition 4: (Not Active) - (Size=98.9 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 99BF1283)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=200 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1662.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================