Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 04.02.2015, 12:06   #1
Heitschi
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hallo,
ich habe seit einiger Zeit folgende Probleme beim Surfen: a) Es taucht Werbung im Browser auf, b) Werbung wird in neuen Tabs geöffnet, c) Werbung wird in neuen Browserfenstern geöffnet, d) der Browser springt von alleine (ohne scrollen oder Tastenbefehle) an das Ende oder den Anfang der Seite und e) Werbung taucht auch unglaublich viel im Text auf (durch Markierung/ doppelt unterstrichen).
Ich dachte zuerst, dass es am Browser (Firefox) liegt. Daraufhin habe ich mir Chrome heruntergeladen, jedoch treten die gleichen Probleme auf.
Zeitlich könnte es hinkommen, dass diese Probleme aufgetreten sind, nachdem ich Avira Antivir heruntergeladen habe. Sicher bin ich mir da nicht. Daraufhin habe ich außerdem Avira deinstalliert und durch Panda Free Antivirus ersetzt. Eine Verbesserung hat sich dadurch nicht ergeben.
Noch etwas ist mir aufgefallen, obwohl ich nicht weiß, ob es damit zu tun hat: Immer wieder möchte ein Programm, dass ich es installiere. Wenn ich den PC herunterfahren oder neu starten möchte, wird dies durch dieses Programm blockiert (ich muss dann das Herunterfahren erzwingen). Nach dem Neustart ist auf meinem Desktop das Symbol "Continue Live Installation".

Ich habe die beschriebenen Schritte durchgeführt. Dazu folgende Infos: a) Bei defogger kam keine Fehlermeldung. b) Bei GMER ist ein Fehler aufgetreten, wodurch ich das Programm nicht starten konnte.

Hier meine Logfiles:
FRST

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Jan (administrator) on LENOVO-PC-JAN on 04-02-2015 10:58:12
Running from C:\Users\Jan\Downloads
Loaded Profiles: Jan (Available profiles: Jan)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security) C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Users\Jan\AppData\Roaming\VOPackage\VOsrv.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
() C:\Users\Jan\AppData\Local\gmsd_de_174\upgmsd_de_174.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(SoftBrain Technologies Ltd.) C:\Users\Jan\AppData\Local\SmartWeb\SmartWebHelper.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
() C:\Users\Jan\AppData\Local\wincheck\wincheck.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
() C:\Program Files (x86)\gmsd_de_174\gmsd_de_174.exe
(SoftBrain Technologies Ltd.) C:\Users\Jan\AppData\Local\SmartWeb\SmartWebApp.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files\lenovo\Lenovo Solution Center\LSCNotify.exe
(ClientConnect LTD) C:\Program Files (x86)\LenovoBrowserGuard\Main\bin\CltMngSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(ClientConnect LTD) C:\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\cltmng.exe
(ClientConnect LTD) C:\Program Files (x86)\LenovoBrowserGuard\UI\bin\cltmngui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16.0.3327.1030_x64__8wekyb3d8bbwe\onenoteim.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
() C:\Users\Jan\AppData\Local\Temp\nsoA7D2.tmp
() C:\Users\Jan\AppData\Local\igs\IGSrv.exe
(OptimizerMonitor Inc.) C:\Program Files (x86)\IGS\OptimizerMonitor.exe
() C:\Users\Jan\AppData\Local\igs\igs.exe
() C:\Users\Jan\AppData\Local\ConvertAd\CASrv.exe
() C:\Users\Jan\AppData\Local\Temp\nsxC2BE.tmp
() C:\Users\Jan\AppData\Local\ConvertAd\ConvertAd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Jan\Desktop\Defogger.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-08-26] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-08-26] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [552960 2013-05-15] (Vimicro)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [WinCheck] => C:\Users\Jan\AppData\Local\wincheck\wincheck.exe [268288 2015-01-19] ()
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
HKLM-x32\...\Run: [gmsd_de_174] => C:\Program Files (x86)\gmsd_de_174\gmsd_de_174.exe [3979920 2015-02-01] ()
HKLM-x32\...\Run: [SmartWeb] => C:\Users\Jan\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-01-28] (SoftBrain Technologies Ltd.)
HKLM-x32\...\RunOnce: [upgmsd_de_174.exe] => C:\Users\Jan\AppData\Local\gmsd_de_174\upgmsd_de_174.exe [3308736 2015-02-01] ()
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\RunOnce: [Application Restart #1] => C:\Users\Jan\AppData\Local\Pokki\Engine\HostAppService.exe [7846216 2015-01-31] (Pokki)
AppInit_DLLs: C:\PROGRA~2\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64Loader.dll => C:\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64Loader.dll [206152 2014-08-25] (ClientConnect LTD)
AppInit_DLLs-x32: C:\PROGRA~2\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32Loader.dll => C:\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32Loader.dll [173896 2014-08-25] (ClientConnect LTD)
Startup: C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk
ShortcutTarget: SmartWeb.lnk -> C:\Users\Jan\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1421693602&from=cvs&uid=ST1000LM024XHN-M101MBB_S30YJ9BF724819
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2872121507-3017763459-4006799705-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1421693602&from=cvs&uid=ST1000LM024XHN-M101MBB_S30YJ9BF724819&q={searchTerms}
BHO: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
BHO: BlockAndSurf -> {C330D4EC-AFE2-9A69-CAAD-C5E77FABCBCB} -> C:\Program Files (x86)\ver0BlockAndSurf\187_x64.dll ()
BHO-x32: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
Toolbar: HKLM - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
Toolbar: HKLM-x32 - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\OptimizerMonitor.dll [301152] (OptimizerMonitor Inc.)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\OptimizerMonitor.dll [301152] (OptimizerMonitor Inc.)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\OptimizerMonitor.dll [301152] (OptimizerMonitor Inc.)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\OptimizerMonitor.dll [301152] (OptimizerMonitor Inc.)
Winsock: Catalog9 15 C:\WINDOWS\SysWOW64\OptimizerMonitor.dll [301152] (OptimizerMonitor Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1421693602&from=cvs&uid=ST1000LM024XHN-M101MBB_S30YJ9BF724819

FireFox:
========
FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default
FF NewTab: hxxp://istart.webssearches.com/newtab/?type=nt&ts=1421693602&from=cvs&uid=ST1000LM024XHN-M101MBB_S30YJ9BF724819
FF DefaultSearchEngine: webssearches
FF SelectedSearchEngine: webssearches
FF Homepage: hxxp://www.google.com/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\user.js
FF SearchPlugin: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\searchplugins\webssearches.xml
FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\abs@avira.com [2015-01-19]
FF Extension: FF Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\fftoolbar2014@etech.com [2015-01-19]
FF Extension: SparPilot - Gutscheine & mehr... - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\sparpilot@sparpilot.com [2015-01-19]
FF Extension: Shell Apply Properties Undo Unit - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642} [2015-01-17]
FF Extension: Panda Security Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [2015-02-04]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\fftoolbar2014@etech.com
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\faststartff@gmail.com
FF HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Firefox\Extensions: [{491C5DB0-06FD-A9EC-D0EA-5BA6B97B7E56}] - C:\Program Files (x86)\ver0BlockAndSurf\187.xpi
FF Extension: BlockAndSurf - C:\Program Files (x86)\ver0BlockAndSurf\187.xpi [2015-01-30]

Chrome: 
=======
CHR Profile: C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-25]
CHR Extension: (Google Docs) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-25]
CHR Extension: (Google Drive) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-25]
CHR Extension: (YouTube) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-25]
CHR Extension: (Google-Suche) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-25]
CHR Extension: (Google Tabellen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-25]
CHR Extension: (Google Wallet) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-25]
CHR Extension: (Google Mail) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-25]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 CltMngSvc; C:\Program Files (x86)\LenovoBrowserGuard\Main\bin\CltMngSvc.exe [2538824 2014-08-25] (ClientConnect LTD)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-08-26] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 OptimizerMonitor; C:\Program Files (x86)\IGS\OptimizerMonitor.exe [1820240 2015-01-29] (OptimizerMonitor Inc.) [File not signed]
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 panda_url_filtering; C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe [296760 2014-09-19] (Panda Security)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-25] ()
R2 serverca; C:\Users\Jan\AppData\Local\ConvertAd\CASrv.exe [93184 2015-02-04] () [File not signed]
R2 serverig; C:\Users\Jan\AppData\Local\igs\IGSrv.exe [93184 2015-02-04] () [File not signed]
R2 servervo; C:\Users\Jan\AppData\Roaming\VOPackage\VOsrv.exe [152576 2015-01-19] () [File not signed] <==== ATTENTION
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-11] (IDT, Inc.) [File not signed]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-08-26] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 12b083f; C:\WINDOWS\system32\drivers\12b083f.sys [76752 2014-12-13] () [File not signed]
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R3 panda_url_filteringd; C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys [51288 2014-03-19] (Visicom Media Inc.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R2 VDWFP; C:\WINDOWS\system32\Drivers\VDWFP64.sys [39800 2014-05-12] (Superfish, Inc.)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1065728 2013-09-26] (Vimicro Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
R2 webinstrNHKT; C:\WINDOWS\system32\Drivers\webinstrNHKT.sys [50264 2015-01-30] ()
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 10:58 - 2015-02-04 10:58 - 00023643 _____ () C:\Users\Jan\Downloads\FRST.txt
2015-02-04 10:56 - 2015-02-04 10:58 - 00000000 ____D () C:\FRST
2015-02-04 10:56 - 2015-02-04 10:56 - 02131456 _____ (Farbar) C:\Users\Jan\Desktop\FRST64.exe
2015-02-04 10:53 - 2015-02-04 10:53 - 00000468 _____ () C:\Users\Jan\Downloads\defogger_disable.log
2015-02-04 10:53 - 2015-02-04 10:53 - 00000000 _____ () C:\Users\Jan\defogger_reenable
2015-02-04 10:52 - 2015-02-04 10:52 - 00050477 _____ () C:\Users\Jan\Desktop\Defogger.exe
2015-02-04 10:15 - 2015-02-04 10:17 - 00004896 _____ () C:\WINDOWS\SysWOW64\OptimizerMonitor.ini
2015-02-04 10:15 - 2015-02-04 10:17 - 00002680 _____ () C:\WINDOWS\SysWOW64\OptimizerMonitorOff.ini
2015-02-04 10:15 - 2015-02-04 10:17 - 00002680 _____ () C:\WINDOWS\system32\OptimizerMonitorOff.ini
2015-02-04 10:15 - 2015-02-04 10:15 - 00001148 _____ () C:\Users\Jan\Desktop\Continue Live Installation.lnk
2015-02-04 10:15 - 2015-02-04 10:15 - 00000000 ____D () C:\Program Files (x86)\IGS
2015-02-04 10:15 - 2015-01-29 14:22 - 00301152 _____ (OptimizerMonitor Inc.) C:\WINDOWS\SysWOW64\OptimizerMonitor.dll
2015-02-04 10:14 - 2015-02-04 10:14 - 00000000 ____D () C:\Users\Jan\AppData\Local\igs
2015-02-04 09:40 - 2015-02-04 09:46 - 00000000 ____D () C:\Users\Jan\AppData\Local\gmsd_de_174
2015-02-04 09:40 - 2015-02-04 09:40 - 01095584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Jan\Downloads\avira_registry_cleaner_de.exe
2015-02-04 09:40 - 2015-02-04 09:40 - 00004036 _____ () C:\WINDOWS\System32\Tasks\SmartWeb Upgrade Trigger Task
2015-02-04 09:40 - 2015-02-04 09:40 - 00000000 ____D () C:\Users\Jan\AppData\Local\SmartWeb
2015-02-04 09:40 - 2015-02-04 09:40 - 00000000 ____D () C:\Program Files (x86)\gmsd_de_174
2015-02-04 09:05 - 2015-02-04 09:05 - 00000000 ____D () C:\OETemp
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\panda_url_filtering
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security URL Filtering
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\Program Files (x86)\pandasecuritytb
2015-02-04 08:54 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-02-04 08:53 - 2015-02-04 08:54 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-02-04 08:52 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security
2015-02-04 08:51 - 2015-02-04 08:52 - 58043240 _____ () C:\Users\Jan\Downloads\FREEAV1504.exe
2015-02-02 17:40 - 2015-02-02 17:41 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup (1).exe
2015-02-02 17:40 - 2015-02-02 17:40 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup.exe
2015-02-02 13:27 - 2015-02-02 13:27 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\TERA
2015-02-02 13:26 - 2015-02-02 13:26 - 00000000 ____D () C:\Users\Jan\Downloads\Gameforge Live
2015-02-02 13:25 - 2015-02-02 13:25 - 20201072 _____ (Gameforge ) C:\Users\Jan\Downloads\TERA_GameforgeLiveSetup.exe
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\WebApp
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\IDT
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\CyberLink
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\CyberLink
2015-01-30 19:55 - 2015-01-30 19:55 - 00077728 _____ () C:\Users\Jan\Downloads\FLVPlayer-Chrome.exe
2015-01-30 15:23 - 2015-02-04 09:43 - 00000448 _____ () C:\WINDOWS\Tasks\BlockAndSurf Update.job
2015-01-30 15:23 - 2015-01-31 10:00 - 00000000 ____D () C:\Program Files (x86)\ver0BlockAndSurf
2015-01-30 15:23 - 2015-01-30 15:23 - 00050264 _____ () C:\WINDOWS\system32\Drivers\webinstrNHKT.sys
2015-01-30 15:23 - 2015-01-30 15:23 - 00003084 _____ () C:\WINDOWS\System32\Tasks\BlockAndSurf Update
2015-01-30 15:23 - 2015-01-30 15:23 - 00001678 _____ () C:\WINDOWS\patsearch.bin
2015-01-30 15:23 - 2015-01-30 15:23 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_webinstrNHKT_01009.Wdf
2015-01-28 21:01 - 2015-01-28 21:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 20:47 - 2015-01-28 20:47 - 00000000 ____D () C:\Users\Jan\Desktop\Fernuni Hagen
2015-01-25 21:08 - 2015-01-25 21:09 - 00000000 ____D () C:\Users\Jan\Desktop\Wohnungssuche
2015-01-25 20:13 - 2015-01-25 20:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-25 20:11 - 2015-02-04 10:16 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 20:11 - 2015-02-04 09:44 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-25 20:11 - 2015-01-25 20:13 - 00000000 ____D () C:\Users\Jan\AppData\Local\Google
2015-01-25 20:11 - 2015-01-25 20:12 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-25 20:11 - 2015-01-25 20:11 - 00880784 _____ (Google Inc.) C:\Users\Jan\Downloads\ChromeSetup.exe
2015-01-25 20:11 - 2015-01-25 20:11 - 00004104 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-25 20:11 - 2015-01-25 20:11 - 00003868 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-20 20:17 - 2015-01-21 22:03 - 00028672 ___SH () C:\Users\Jan\Downloads\Thumbs.db
2015-01-19 20:00 - 2015-02-04 10:30 - 00000000 ____D () C:\Users\Jan\AppData\Local\ConvertAd
2015-01-19 20:00 - 2015-01-19 20:00 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\SoftwareUpdater
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\ProgramData\Avira
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-01-19 19:58 - 2015-01-19 19:58 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\dlg
2015-01-19 19:56 - 2015-01-19 19:57 - 00000000 ____D () C:\Users\Jan\AppData\Local\wincheck
2015-01-19 19:56 - 2015-01-19 19:56 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\VOPackage
2015-01-19 19:56 - 2015-01-19 19:56 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2015-01-19 19:55 - 2015-01-19 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajaInterEnhance
2015-01-18 21:01 - 2015-02-03 11:06 - 00000000 ____D () C:\Users\Jan\Desktop\Bewerbung
2015-01-18 20:21 - 2015-01-18 20:21 - 00001132 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\OpenOffice
2015-01-18 20:20 - 2015-01-18 20:20 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-18 20:07 - 2015-01-18 20:17 - 164858324 _____ () C:\Users\Jan\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2015-01-18 15:25 - 2015-01-18 15:25 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-01-17 11:43 - 2015-01-17 11:43 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-17 11:43 - 2015-01-17 11:43 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\UXmedia
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\Edtion
2015-01-17 11:34 - 2015-01-17 11:34 - 00000000 __SHD () C:\Users\Jan\AppData\Local\EmieBrowserModeList
2015-01-13 22:26 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:26 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:26 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:26 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:26 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:26 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:26 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:26 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:26 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 22:26 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-07 19:41 - 2015-01-21 21:34 - 00067072 ___SH () C:\Users\Jan\Desktop\Thumbs.db

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 10:57 - 2014-08-26 21:47 - 01847304 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-04 10:53 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan
2015-02-04 10:16 - 2014-12-13 16:01 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2872121507-3017763459-4006799705-1001
2015-02-04 10:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-04 09:57 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Local\Packages
2015-02-04 09:54 - 2013-08-22 15:46 - 00028129 _____ () C:\WINDOWS\setupact.log
2015-02-04 09:49 - 2014-08-27 07:34 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-04 09:49 - 2014-08-27 07:34 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-04 09:49 - 2014-03-18 10:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-04 09:44 - 2014-12-13 15:59 - 00000000 ___DO () C:\Users\Jan\OneDrive
2015-02-04 09:43 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-04 09:42 - 2014-08-26 22:57 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf
2015-02-04 09:42 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-04 09:08 - 2014-03-18 10:44 - 00123244 _____ () C:\WINDOWS\PFRO.log
2015-02-04 09:08 - 2013-08-22 15:44 - 00415104 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-04 09:05 - 2014-08-26 22:59 - 00000000 ____D () C:\ProgramData\Office2013
2015-02-04 09:05 - 2014-08-26 22:45 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-04 08:23 - 2014-12-13 16:15 - 00003942 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DA52ABCC-602A-4952-87CC-9378739E56A8}
2015-02-04 08:20 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan\AppData\Local\Pokki
2015-02-03 09:05 - 2015-01-01 14:00 - 00002347 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-02-01 19:48 - 2014-08-26 22:57 - 00000000 ____D () C:\ProgramData\CyberLink
2015-02-01 19:48 - 2014-08-26 22:48 - 00000000 ____D () C:\ProgramData\Lenovo
2015-01-30 15:47 - 2014-12-14 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 21:17 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-25 15:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-24 21:20 - 2014-12-13 15:12 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2014-12-13 15:12 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-19 20:44 - 2014-08-26 22:49 - 00000000 ____D () C:\ProgramData\McAfee
2015-01-19 20:38 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-19 19:53 - 2014-12-14 12:17 - 00001396 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-19 19:53 - 2014-12-13 15:55 - 00001687 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-17 11:44 - 2014-08-26 22:55 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-17 11:43 - 2014-12-13 16:02 - 00000000 ____D () C:\Users\Jan\AppData\Local\Adobe
2015-01-17 11:43 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Adobe
2015-01-17 11:43 - 2014-08-26 22:55 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-17 08:23 - 2014-08-26 22:57 - 00009736 _____ () C:\WINDOWS\SysWOW64\VisualDiscovery.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\system32\VisualDiscoveryOff.ini
2015-01-14 18:50 - 2014-12-13 17:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 18:48 - 2014-12-13 17:07 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-13 19:34 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

==================== Files in the root of some directories =======

2014-08-26 22:14 - 2014-08-26 22:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Jan\AppData\Local\Temp\362270A4-3E15-7424-D959-B84C15887660.exe
C:\Users\Jan\AppData\Local\Temp\4BCD0FE7-18E4-2031-5542-49664A1ECCCD.dll
C:\Users\Jan\AppData\Local\Temp\4BCD0FE7-18E4-2031-5542-49664A1ECCCD.exe
C:\Users\Jan\AppData\Local\Temp\avgnt.exe
C:\Users\Jan\AppData\Local\Temp\Gw2.exe
C:\Users\Jan\AppData\Local\Temp\LenovoExperienceImprovement.exe
C:\Users\Jan\AppData\Local\Temp\oct20A0.tmp.exe
C:\Users\Jan\AppData\Local\Temp\oct9C03.tmp.exe
C:\Users\Jan\AppData\Local\Temp\octF2FE.tmp.exe
C:\Users\Jan\AppData\Local\Temp\SpOrder.dll
C:\Users\Jan\AppData\Local\Temp\SPSetup.exe
C:\Users\Jan\AppData\Local\Temp\Uninstall.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 17:37

==================== End Of Log ============================
         
FRST Addition
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015
Ran by Jan at 2015-02-04 10:58:59
Running from C:\Users\Jan\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda Free Antivirus (Enabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Free Antivirus (Enabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 Lenovo Photo Master (HKLM-x32\...\InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 1.0.1823.01 - CyberLink Corp.)
 Lenovo Photo Master (x32 Version: 1.0.1823.01 - CyberLink Corp.) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
BlockAndSurf (HKLM-x32\...\4ACA2973-4B86-0491-333D-AC22DF807A51) (Version:  - BlockAndSurf-software) <==== ATTENTION
ConvertAd (HKLM-x32\...\ConvertAd) (Version: 1.0.0.0 - ConvertAd) <==== ATTENTION!
CyberLink MediaStory (HKLM-x32\...\InstallShield_{55762F9A-FCE3-45d5-817B-051218658423}) (Version: 1.0.1314 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dependency Package Update (Version: 1.6.25.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.35 - Lenovo)
Energy Manager (x32 Version: 1.0.0.35 - Lenovo) Hidden
GamesDesktop 014.174 (HKLM-x32\...\gmsd_de_174_is1) (Version:  - GAMESDESKTOP) <==== ATTENTION
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.94 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Hightail for Lenovo (HKLM\...\{2F10E937-F6D7-4174-8AB9-B299E8FC5CEC}) (Version: 2.4.97.2857 - Hightail, Inc.)
Host App Service (HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Pokki) (Version: 0.269.5.460 - Pokki)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6490.0 - IDT)
IGS (HKLM-x32\...\IGS) (Version:  - )
igsc (HKLM-x32\...\igsc) (Version: 1.0.0.0 - igs)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1013 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
Lenovo Browser Guard (HKLM-x32\...\LenovoBrowserGuard) (Version: 2.16.50.5 - ClientConnect LTD)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.25.00 - Lenovo Group Limited)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.13.926.1 - Vimicro)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)
Lenovo FusionEngine  (HKLM-x32\...\Lenovo FusionEngine) (Version: 1.0.13.0 - Lenovo, Inc.)
Lenovo Mobile Phone Wireless Import (HKLM-x32\...\InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}) (Version: 1.1.1.9 - Lenovo)
Lenovo Mobile Phone Wireless Import (x32 Version: 1.1.1.9 - Lenovo) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
Lenovo SHAREit (HKLM-x32\...\Lenovo SHAREit_is1) (Version: 2.0.5.0 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{4C2B6F96-3AED-4E3F-8DCE-917863D1E6B1}) (Version: 2.7.003.00 - Lenovo Group Limited)
Lenovo VeriFace (HKLM\...\Lenovo VeriFace) (Version: 5.0.13.5261 - Lenovo)
Lenovo Web Start (HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.2.53457 - Pokki)
Lenovo_Wireless_Driver (HKLM-x32\...\{5D642A72-8194-4A22-80DA-11FE610CCA8E}) (Version: 6.30.223.143 - Lenovo)
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Free Antivirus (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0000 - Panda Security)
Panda Free Antivirus (Version: 7.23.00.0000 - Panda Security) Hidden
Panda Security Toolbar (HKLM-x32\...\pandasecuritytb) (Version: 4.2.1.7 - Panda Security and Visicom Media Inc.)
Panda Security URL Filtering (HKLM-x32\...\Panda Security URL Filtering) (Version: 2.0.2.0 - Panda Security)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Remote Desktop Access (VuuPC) (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION
SmartWeb (HKLM-x32\...\SmartWeb) (Version: 8.0.7 - SoftBrain Technologies Ltd.) <==== ATTENTION
Software Updater (HKLM-x32\...\SoftwareUpdater) (Version: 1.0.0.0 - Software Updater Ltd)
Start Menu (HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Pokki_Start_Menu) (Version: 0.269.5.460 - Pokki)
Superfish Inc. VisualDiscovery (HKLM-x32\...\Superfish Inc. VisualDiscovery) (Version: 1.0.0.1 - Superfish) <==== ATTENTION
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Wajam (HKLM-x32\...\WajaInterEnhance) (Version: 2.22.2.15 (i2.6) - WajaInterEnhance) <==== ATTENTION
webssearches uninstall (HKLM-x32\...\webssearches uninstall) (Version:  - webssearches) <==== ATTENTION
WinCheck (HKLM-x32\...\wincheck) (Version: 1.0.0.0 - WinCheck) <==== ATTENTION!
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-02-2015 15:15:48 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2096A84C-18D0-4905-99FD-E21D2BC0095A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {2A2DFF3A-D7F2-43AC-9C20-D01C3E785BB6} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-14] (Microsoft Corporation)
Task: {2EF51ED5-E206-4E25-81AB-E84D5B1B285B} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2014-12-21] (Lenovo)
Task: {5795AEA2-D68C-4F8E-A913-A125754E3F21} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: {584D15C6-A669-4BA4-9701-A071B8B58E09} - System32\Tasks\SmartWeb Upgrade Trigger Task => C:\Users\Jan\AppData\Local\SmartWeb\SmartWebHelper.exe [2015-01-28] (SoftBrain Technologies Ltd.)
Task: {67A8703A-F7A1-4F6B-A133-6A9906F7E542} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-10-16] ()
Task: {70362DC9-33BA-4DDF-850D-466ED3AA6A1D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: {7DB66B55-B4B5-42CA-8153-67163C3E7742} - System32\Tasks\BlockAndSurf Update => C:\Program Files (x86)\ver0BlockAndSurf\J6BlockAndSurfR79.exe <==== ATTENTION
Task: {8F617041-9525-40CD-96EE-F6238AFB5785} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-10-16] (Lenovo)
Task: {9DE7D9CD-A4FC-47F7-AA97-FA7B1D0CDD0E} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2014-05-21] ()
Task: {A14B0958-30D8-474A-AE97-99C5201D9BFA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-10-16] (Lenovo)
Task: {B9DFC9AA-5070-4376-A0F6-21F190D35869} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {CC907E5A-142A-44F7-AB66-D673E2DBDABC} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-10-16] ()
Task: {D2183EEA-BEE2-4A54-80EA-0FE8355A6B58} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {D29633D3-AC2E-44A8-9DC5-71671624E746} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2014-10-16] (Lenovo)
Task: C:\WINDOWS\Tasks\BlockAndSurf Update.job => C:\Program Files (x86)\ver0BlockAndSurf\J6BlockAndSurfR79.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-08-26 22:52 - 2012-04-25 03:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2015-01-19 19:56 - 2015-01-19 19:56 - 00152576 _____ () C:\Users\Jan\AppData\Roaming\VOPackage\VOsrv.exe
2014-08-26 22:57 - 2014-08-26 22:57 - 00068368 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
2014-08-26 22:57 - 2014-08-26 22:57 - 00669288 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfDataStorageInterface.dll
2015-02-04 09:40 - 2015-02-01 14:42 - 03308736 _____ () C:\Users\Jan\AppData\Local\gmsd_de_174\upgmsd_de_174.exe
2015-01-19 19:49 - 2015-01-19 19:49 - 00268288 _____ () C:\Users\Jan\AppData\Local\wincheck\wincheck.exe
2015-02-04 09:40 - 2015-02-01 14:42 - 03979920 _____ () C:\Program Files (x86)\gmsd_de_174\gmsd_de_174.exe
2015-02-04 10:14 - 2015-02-04 10:14 - 00178992 _____ () C:\Users\Jan\AppData\Local\Temp\nsoA7D2.tmp
2015-02-04 10:14 - 2015-02-04 10:14 - 00093184 _____ () C:\Users\Jan\AppData\Local\igs\IGSrv.exe
2015-02-04 03:02 - 2015-02-04 03:02 - 00244224 _____ () C:\Users\Jan\AppData\Local\igs\igs.exe
2015-02-04 09:41 - 2015-02-04 10:30 - 00093184 _____ () C:\Users\Jan\AppData\Local\ConvertAd\CASrv.exe
2015-02-04 10:30 - 2015-02-04 10:30 - 00337712 _____ () C:\Users\Jan\AppData\Local\Temp\nsxC2BE.tmp
2015-02-04 04:13 - 2015-02-04 04:13 - 02993664 _____ () C:\Users\Jan\AppData\Local\ConvertAd\ConvertAd.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Jan\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\OptimizerMonitor => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VisualDiscovery => ""="service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2872121507-3017763459-4006799705-500 - Administrator - Disabled)
Gast (S-1-5-21-2872121507-3017763459-4006799705-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2872121507-3017763459-4006799705-1003 - Limited - Enabled)
Jan (S-1-5-21-2872121507-3017763459-4006799705-1001 - Administrator - Enabled) => C:\Users\Jan

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/04/2015 08:29:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 40.0.2214.93, Zeitstempel: 0x54c46198
Name des fehlerhaften Moduls: chrome.dll, Version: 40.0.2214.93, Zeitstempel: 0x54c45d6b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x01249e77
ID des fehlerhaften Prozesses: 0x185c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (02/03/2015 04:28:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 40.0.2214.93, Zeitstempel: 0x54c46198
Name des fehlerhaften Moduls: chrome.dll, Version: 40.0.2214.93, Zeitstempel: 0x54c45d6b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x01249e77
ID des fehlerhaften Prozesses: 0xd14
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (02/03/2015 11:06:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: soffice.bin, Version: 4.0.9774.500, Zeitstempel: 0x53d77a01
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc000041d
Fehleroffset: 0x13d708d8
ID des fehlerhaften Prozesses: 0x2584
Startzeit der fehlerhaften Anwendung: 0xsoffice.bin0
Pfad der fehlerhaften Anwendung: soffice.bin1
Pfad des fehlerhaften Moduls: soffice.bin2
Berichtskennung: soffice.bin3
Vollständiger Name des fehlerhaften Pakets: soffice.bin4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: soffice.bin5

Error: (02/03/2015 11:06:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: soffice.bin, Version: 4.0.9774.500, Zeitstempel: 0x53d77a01
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x13d708d8
ID des fehlerhaften Prozesses: 0x2584
Startzeit der fehlerhaften Anwendung: 0xsoffice.bin0
Pfad der fehlerhaften Anwendung: soffice.bin1
Pfad des fehlerhaften Moduls: soffice.bin2
Berichtskennung: soffice.bin3
Vollständiger Name des fehlerhaften Pakets: soffice.bin4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: soffice.bin5

Error: (02/03/2015 09:16:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 40.0.2214.93, Zeitstempel: 0x54c46198
Name des fehlerhaften Moduls: chrome.dll, Version: 40.0.2214.93, Zeitstempel: 0x54c45d6b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x01249e77
ID des fehlerhaften Prozesses: 0x18c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (02/03/2015 09:05:44 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/03/2015 09:05:27 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/03/2015 09:05:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/03/2015 09:05:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/02/2015 02:01:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 40.0.2214.93, Zeitstempel: 0x54c46198
Name des fehlerhaften Moduls: chrome.dll, Version: 40.0.2214.93, Zeitstempel: 0x54c45d6b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x01249e77
ID des fehlerhaften Prozesses: 0xb94
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5


System errors:
=============
Error: (02/04/2015 09:43:24 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/04/2015 09:43:08 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126

Error: (02/04/2015 09:42:14 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (02/04/2015 09:42:14 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (02/04/2015 09:42:08 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (02/04/2015 09:42:08 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (02/04/2015 09:08:54 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/04/2015 09:08:40 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126

Error: (02/04/2015 08:54:51 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/04/2015 08:44:29 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.


Microsoft Office Sessions:
=========================
Error: (02/04/2015 08:29:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe40.0.2214.9354c46198chrome.dll40.0.2214.9354c45d6bc000000501249e77185c01d0404b9c0d4d59C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\chrome.dll7e4d1964-ac3f-11e4-8264-6002924e5ec3

Error: (02/03/2015 04:28:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe40.0.2214.9354c46198chrome.dll40.0.2214.9354c45d6bc000000501249e77d1401d03f93b72c7f3fC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\chrome.dll3c49da56-abb9-11e4-8264-6002924e5ec3

Error: (02/03/2015 11:06:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: soffice.bin4.0.9774.50053d77a01unknown0.0.0.000000000c000041d13d708d8258401d03f98eb952c06C:\Program Files (x86)\OpenOffice 4\program\soffice.binunknown522394fe-ab8c-11e4-8264-6002924e5ec3

Error: (02/03/2015 11:06:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: soffice.bin4.0.9774.50053d77a01unknown0.0.0.000000000c000000513d708d8258401d03f98eb952c06C:\Program Files (x86)\OpenOffice 4\program\soffice.binunknown510a3f7d-ab8c-11e4-8264-6002924e5ec3

Error: (02/03/2015 09:16:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe40.0.2214.9354c46198chrome.dll40.0.2214.9354c45d6bc000000501249e7718c01d03f882a953dadC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\chrome.dlle6cdbba5-ab7c-11e4-8264-6002924e5ec3

Error: (02/03/2015 09:05:44 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Users\Jan\AppData\Local\Pokki\Engine\HostAppService.exe

Error: (02/03/2015 09:05:27 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Users\Jan\AppData\Local\Pokki\Engine\HostAppService.exe

Error: (02/03/2015 09:05:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Users\Jan\AppData\Local\Temp\oct20A0.tmp.exe

Error: (02/03/2015 09:05:08 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Users\Jan\AppData\Local\Temp\oct20A0.tmp.exe

Error: (02/02/2015 02:01:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe40.0.2214.9354c46198chrome.dll40.0.2214.9354c45d6bc000000501249e77b9401d03ee296875d78C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\chrome.dll9e426613-aadb-11e4-8264-6002924e5ec3


CodeIntegrity Errors:
===================================
  Date: 2015-02-04 09:42:57.460
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-04 09:08:12.502
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-01 19:53:07.337
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-30 15:47:03.494
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-30 14:50:40.882
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-20 19:50:09.519
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-19 20:43:48.681
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-17 08:22:49.231
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-01 13:57:34.917
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-12-21 15:26:09.295
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Percentage of memory in use: 29%
Total physical RAM: 8116.27 MB
Available physical RAM: 5702.96 MB
Total Pagefile: 9396.27 MB
Available Pagefile: 6797.8 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:889.18 GB) (Free:837.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B7E5F53B)

Partition: GPT Partition Type.

==================== End Of Log ============================
         
Abschließend wäre es klasse, wenn ich einen Tipp bzgl. des Antivirenprogramms bekommen kann: Bin ich mit Panda gut unterwegs oder sollte ich mir ein anderes herunterladen (bevorzugt freeware)?
Diese Art des Surfens ist unglaublich störend und ich würde mich unglaublich über Hilfe freuen!!
In diesem Sinne im Voraus vielen Dank!!!

Alt 04.02.2015, 14:30   #2
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hi, ich habe dein Thema in Arbeit und melde mich gleich bei dir
__________________

__________________

Alt 04.02.2015, 14:35   #3
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



So dann fangen wir einmal an

bitte alle Programme die ich dir poste als Admin ausführen.

Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    BlockAndSurf
    ConvertAd
    GamesDesktop
    Remote Desktop Access
    SmartWeb
    Superfish Inc. VisualDiscovery
    Wajam
    webssearches uninstall
    WinCheck

  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 



Schritt 2:

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3:[/SIZE]

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



Schritt 4:[/SIZE]

erstelle ein neues FRST Logfile und poste es hier
__________________
__________________

Alt 04.02.2015, 15:26   #4
Heitschi
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



So, hier meine Logfiles:
AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v4.109 - Bericht erstellt am 04/02/2015 um 15:07:57
# Aktualisiert 24/01/2015 von Xplode
# Database : 2015-02-03.1 [Live]
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Jan - LENOVO-PC-JAN
# Gestartet von : C:\Users\Jan\Desktop\AdwCleaner_4.109.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : CltMngSvc
Dienst Gelöscht : pcsuservice
Dienst Gelöscht : webinstrNHKT

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyBestOffersToday
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\pc speed up
Ordner Gelöscht : C:\Program Files (x86)\pc speed up
Ordner Gelöscht : C:\Program Files (x86)\predm
Ordner Gelöscht : C:\Program Files (x86)\LenovoBrowserGuard
Ordner Gelöscht : C:\Program Files (x86)\ver0BlockAndSurf
Ordner Gelöscht : C:\Program Files (x86)\mbot_de_472
Ordner Gelöscht : C:\Users\Jan\AppData\Local\Microsoft\Silverlight\OutOfBrowser\Speedchecker.PCSpeedUp
Ordner Gelöscht : C:\Users\Jan\AppData\Local\LenovoBrowserGuard
Ordner Gelöscht : C:\Users\Jan\AppData\Local\mbot_de_472
Ordner Gelöscht : C:\Users\Jan\AppData\Roaming\SoftwareUpdater
Ordner Gelöscht : C:\Users\Jan\Documents\PCSpeedUp
Ordner Gelöscht : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\sparpilot@sparpilot.com
Ordner Gelöscht : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\fftoolbar2014@etech.com
Datei Gelöscht : C:\WINDOWS\patsearch.bin
Datei Gelöscht : C:\Users\Jan\AppData\Local\Temp\Uninstall.exe
Datei Gelöscht : C:\WINDOWS\System32\drivers\Msft_Kernel_webinstrNHKT_01009.Wdf
Datei Gelöscht : C:\WINDOWS\System32\drivers\webinstrNHKT.sys
Datei Gelöscht : C:\WINDOWS\System32\drivers\VDWFP64.sys
Datei Gelöscht : C:\Users\Jan\Desktop\PC Speed Up.lnk
Datei Gelöscht : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\searchplugins\webssearches.xml
Datei Gelöscht : C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\user.js
Datei Gelöscht : C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage
Datei Gelöscht : C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage-journal

***** [ Tasks ] *****

Task Gelöscht : BlockAndSurf Update
Task Gelöscht : PC SpeedUp Service Deactivator
Task Gelöscht : SmartWeb Upgrade Trigger Task

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Jan\Desktop\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Jan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Jan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [faststartff@gmail.com]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [fftoolbar2014@etech.com]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{491C5DB0-06FD-A9EC-D0EA-5BA6B97B7E56}]
Schlüssel Gelöscht : HKCU\Software\Classes\pokki
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [pcspeedup]
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKCU\Software\Mozilla\Extends
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mbot_de_472]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B89F5C49-51DB-4974-AB5A-E25901AA339C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E9B5B0D2-D08A-49FC-8B5C-159B60BAA268}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\Pokki
Schlüssel Gelöscht : HKCU\Software\Speedchecker Limited
Schlüssel Gelöscht : HKCU\Software\Tutorials
Schlüssel Gelöscht : HKCU\Software\TutoTag
Schlüssel Gelöscht : HKCU\Software\WajIEnhance
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\MyBestOffersToday
Schlüssel Gelöscht : HKLM\SOFTWARE\Speedchecker Limited
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKLM\SOFTWARE\webssearchesSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\GAMESDESKTOP
Schlüssel Gelöscht : HKLM\SOFTWARE\IHProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\LenovoBrowserGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\VisualDiscovery
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LenovoBrowserGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mbot_de_472_is1
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Speedchecker Limited
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCSU-SL_is1
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32Loader.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64Loader.dll

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17416

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]

-\\ Mozilla Firefox v35.0.1 (x86 de)

[rt5105eg.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://istart.webssearches.com/newtab/?type=nt&ts=1421693602&from=cvs&uid=ST1000LM024XHN-M101MBB_S30YJ9BF724819");
[rt5105eg.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.defaultenginename", "webssearches");
[rt5105eg.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.searchengine.alias", "webssearches");
[rt5105eg.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.searchengine.iconURL", "hxxp://istart.webssearches.com/favicon.ico");
[rt5105eg.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.searchengine.name", "webssearches");
[rt5105eg.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.searchengine.url", "hxxp://istart.webssearches.com/web/?type=ds&ts=1421693602&from=cvs&uid=ST1000LM024XHN-M101MBB_S30YJ9BF724819&q={searchTerms}");
[rt5105eg.default\prefs.js] - Zeile gelöscht : user_pref("browser.search.selectedEngine", "webssearches");

-\\ Google Chrome v40.0.2214.94


*************************

AdwCleaner[R0].txt - [9582 octets] - [04/02/2015 15:06:43]
AdwCleaner[S0].txt - [9284 octets] - [04/02/2015 15:07:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9344 octets] ##########
         
--- --- ---

[/CODE]

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8.1 x64
Ran by Jan on 04.02.2015 at 15:14:57,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\WINDOWS\prefetch\SPEEDUP_SOFT_PARTNER.EXE-472B1E86.pf
Successfully deleted: [File] C:\WINDOWS\prefetch\SPEEDUP_SOFT_PARTNER.TMP-D6B2F652.pf



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Jan\AppData\Roaming\mozilla\firefox\profiles\rt5105eg.default\prefs.js

user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
user_pref("browser.search.searchengine.ptid", "cvs");
user_pref("browser.search.searchengine.uid", "ST1000LM024XHN-M101MBB_S30YJ9BF724819");



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.02.2015 at 15:17:20,19
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Jan (administrator) on LENOVO-PC-JAN on 04-02-2015 15:19:42
Running from C:\Users\Jan\Desktop
Loaded Profiles: Jan (Available profiles: Jan)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(OptimizerMonitor Inc.) C:\Program Files (x86)\IGS\OptimizerMonitor.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security) C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Users\Jan\AppData\Local\igs\IGSrv.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16.0.3327.1030_x64__8wekyb3d8bbwe\onenoteim.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files\lenovo\Lenovo Solution Center\LSCNotify.exe
() C:\Users\Jan\AppData\Local\igs\igs.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-08-26] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-08-26] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [552960 2013-05-15] (Vimicro)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
HKLM-x32\...\Run: [gmsd_de_174] => [X]
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\RunOnce: [Application Restart #1] => C:\Users\Jan\AppData\Local\Pokki\Engine\HostAppService.exe [7846216 2015-01-31] (Pokki)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
BHO: BlockAndSurf -> {C330D4EC-AFE2-9A69-CAAD-C5E77FABCBCB} -> C:\Program Files (x86)\ver0BlockAndSurf\187_x64.dll No File
BHO-x32: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
Toolbar: HKLM - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
Toolbar: HKLM-x32 - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default
FF Homepage: hxxp://www.google.com/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\abs@avira.com [2015-01-19]
FF Extension: Shell Apply Properties Undo Unit - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642} [2015-01-17]
FF Extension: Panda Security Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [2015-02-04]
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\fftoolbar2014@etech.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\ver0BlockAndSurf\187.xpi [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-25]
CHR Extension: (Google Docs) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-25]
CHR Extension: (Google Drive) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-25]
CHR Extension: (YouTube) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-25]
CHR Extension: (Google-Suche) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-25]
CHR Extension: (Google Tabellen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-25]
CHR Extension: (Google Wallet) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-25]
CHR Extension: (Google Mail) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-25]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-08-26] (Lenovo(beijing) Limited)
U3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 OptimizerMonitor; C:\Program Files (x86)\IGS\OptimizerMonitor.exe [1820240 2015-01-29] (OptimizerMonitor Inc.) [File not signed]
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 panda_url_filtering; C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe [296760 2014-09-19] (Panda Security)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-25] ()
R2 serverig; C:\Users\Jan\AppData\Local\igs\IGSrv.exe [93184 2015-02-04] () [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-11] (IDT, Inc.) [File not signed]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-08-26] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 12b083f; C:\WINDOWS\system32\drivers\12b083f.sys [76752 2014-12-13] () [File not signed]
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R3 panda_url_filteringd; C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys [51288 2014-03-19] (Visicom Media Inc.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1065728 2013-09-26] (Vimicro Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 15:17 - 2015-02-04 15:17 - 00001164 _____ () C:\Users\Jan\Desktop\JRT.txt
2015-02-04 15:13 - 2015-02-04 15:13 - 01388274 _____ (Thisisu) C:\Users\Jan\Desktop\JRT.exe
2015-02-04 15:10 - 2015-02-04 15:10 - 00009476 _____ () C:\Users\Jan\Desktop\AdwCleaner[S0].txt
2015-02-04 15:05 - 2015-02-04 15:08 - 00000000 ____D () C:\AdwCleaner
2015-02-04 15:04 - 2015-02-04 15:04 - 02194432 _____ () C:\Users\Jan\Desktop\AdwCleaner_4.109.exe
2015-02-04 14:59 - 2015-02-04 14:59 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\QuickScan
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-02-04 14:49 - 2015-02-04 14:49 - 00001295 _____ () C:\Users\Jan\Desktop\Revo Uninstaller.lnk
2015-02-04 14:49 - 2015-02-04 14:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-04 14:48 - 2015-02-04 14:49 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jan\Desktop\revosetup95.exe
2015-02-04 11:01 - 2015-02-04 11:02 - 00380416 _____ () C:\Users\Jan\Desktop\Gmer-19357.exe
2015-02-04 10:59 - 2015-02-04 15:19 - 00018994 _____ () C:\Users\Jan\Desktop\FRST.txt
2015-02-04 10:59 - 2015-02-04 10:59 - 00036337 _____ () C:\Users\Jan\Desktop\Addition.txt
2015-02-04 10:58 - 2015-02-04 10:59 - 00041196 _____ () C:\Users\Jan\Downloads\FRST.txt
2015-02-04 10:58 - 2015-02-04 10:59 - 00036337 _____ () C:\Users\Jan\Downloads\Addition.txt
2015-02-04 10:56 - 2015-02-04 15:19 - 00000000 ____D () C:\FRST
2015-02-04 10:56 - 2015-02-04 10:56 - 02131456 _____ (Farbar) C:\Users\Jan\Desktop\FRST64.exe
2015-02-04 10:53 - 2015-02-04 10:53 - 00000468 _____ () C:\Users\Jan\Downloads\defogger_disable.log
2015-02-04 10:53 - 2015-02-04 10:53 - 00000000 _____ () C:\Users\Jan\defogger_reenable
2015-02-04 10:52 - 2015-02-04 10:52 - 00050477 _____ () C:\Users\Jan\Desktop\Defogger.exe
2015-02-04 10:15 - 2015-02-04 15:11 - 00004896 _____ () C:\WINDOWS\SysWOW64\OptimizerMonitor.ini
2015-02-04 10:15 - 2015-02-04 15:11 - 00002680 _____ () C:\WINDOWS\SysWOW64\OptimizerMonitorOff.ini
2015-02-04 10:15 - 2015-02-04 15:11 - 00002680 _____ () C:\WINDOWS\system32\OptimizerMonitorOff.ini
2015-02-04 10:15 - 2015-02-04 10:15 - 00000000 ____D () C:\Program Files (x86)\IGS
2015-02-04 10:15 - 2015-01-29 14:22 - 00301152 _____ (OptimizerMonitor Inc.) C:\WINDOWS\SysWOW64\OptimizerMonitor.dll
2015-02-04 10:14 - 2015-02-04 10:14 - 00000000 ____D () C:\Users\Jan\AppData\Local\igs
2015-02-04 09:40 - 2015-02-04 09:40 - 01095584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Jan\Downloads\avira_registry_cleaner_de.exe
2015-02-04 09:05 - 2015-02-04 09:05 - 00000000 ____D () C:\OETemp
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\panda_url_filtering
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security URL Filtering
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\Program Files (x86)\pandasecuritytb
2015-02-04 08:54 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-02-04 08:53 - 2015-02-04 08:54 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-02-04 08:52 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security
2015-02-04 08:51 - 2015-02-04 08:52 - 58043240 _____ () C:\Users\Jan\Downloads\FREEAV1504.exe
2015-02-02 17:40 - 2015-02-02 17:41 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup (1).exe
2015-02-02 17:40 - 2015-02-02 17:40 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup.exe
2015-02-02 13:27 - 2015-02-02 13:27 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\TERA
2015-02-02 13:26 - 2015-02-02 13:26 - 00000000 ____D () C:\Users\Jan\Downloads\Gameforge Live
2015-02-02 13:25 - 2015-02-02 13:25 - 20201072 _____ (Gameforge ) C:\Users\Jan\Downloads\TERA_GameforgeLiveSetup.exe
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\WebApp
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\IDT
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\CyberLink
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\CyberLink
2015-01-30 19:55 - 2015-01-30 19:55 - 00077728 _____ () C:\Users\Jan\Downloads\FLVPlayer-Chrome.exe
2015-01-28 21:01 - 2015-01-28 21:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 20:47 - 2015-01-28 20:47 - 00000000 ____D () C:\Users\Jan\Desktop\Fernuni Hagen
2015-01-25 21:08 - 2015-01-25 21:09 - 00000000 ____D () C:\Users\Jan\Desktop\Wohnungssuche
2015-01-25 20:13 - 2015-01-25 20:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-25 20:11 - 2015-02-04 15:16 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 20:11 - 2015-02-04 15:09 - 00001128 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-25 20:11 - 2015-01-25 20:13 - 00000000 ____D () C:\Users\Jan\AppData\Local\Google
2015-01-25 20:11 - 2015-01-25 20:12 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-25 20:11 - 2015-01-25 20:11 - 00880784 _____ (Google Inc.) C:\Users\Jan\Downloads\ChromeSetup.exe
2015-01-25 20:11 - 2015-01-25 20:11 - 00004104 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-25 20:11 - 2015-01-25 20:11 - 00003868 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-20 20:17 - 2015-01-21 22:03 - 00028672 ___SH () C:\Users\Jan\Downloads\Thumbs.db
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\ProgramData\Avira
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-01-19 19:58 - 2015-01-19 19:58 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\dlg
2015-01-18 21:01 - 2015-02-03 11:06 - 00000000 ____D () C:\Users\Jan\Desktop\Bewerbung
2015-01-18 20:21 - 2015-01-18 20:21 - 00001132 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\OpenOffice
2015-01-18 20:20 - 2015-01-18 20:20 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-18 20:07 - 2015-01-18 20:17 - 164858324 _____ () C:\Users\Jan\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2015-01-18 15:25 - 2015-01-18 15:25 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-01-17 11:43 - 2015-01-17 11:43 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-17 11:43 - 2015-01-17 11:43 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\UXmedia
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\Edtion
2015-01-17 11:34 - 2015-01-17 11:34 - 00000000 __SHD () C:\Users\Jan\AppData\Local\EmieBrowserModeList
2015-01-13 22:26 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:26 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:26 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:26 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:26 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:26 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:26 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:26 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:26 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 22:26 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-07 19:41 - 2015-01-21 21:34 - 00067072 ___SH () C:\Users\Jan\Desktop\Thumbs.db

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 15:19 - 2013-08-22 15:46 - 00028659 _____ () C:\WINDOWS\setupact.log
2015-02-04 15:14 - 2014-12-13 16:01 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2872121507-3017763459-4006799705-1001
2015-02-04 15:11 - 2014-12-13 15:59 - 00000000 ___DO () C:\Users\Jan\OneDrive
2015-02-04 15:09 - 2014-03-18 10:44 - 00125566 _____ () C:\WINDOWS\PFRO.log
2015-02-04 15:09 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-04 15:08 - 2014-12-14 12:17 - 00001088 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-04 15:08 - 2014-12-13 15:55 - 00001014 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-04 15:08 - 2014-08-26 22:57 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf
2015-02-04 15:08 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-04 15:01 - 2014-08-26 22:15 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2015-02-04 15:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-04 14:56 - 2014-08-26 21:47 - 01891264 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-04 14:49 - 2014-12-13 16:15 - 00003942 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DA52ABCC-602A-4952-87CC-9378739E56A8}
2015-02-04 11:15 - 2014-08-27 07:34 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-04 11:15 - 2014-08-27 07:34 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-04 11:15 - 2014-03-18 10:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-04 10:53 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan
2015-02-04 09:57 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Local\Packages
2015-02-04 09:08 - 2013-08-22 15:44 - 00415104 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-04 09:05 - 2014-08-26 22:59 - 00000000 ____D () C:\ProgramData\Office2013
2015-02-04 09:05 - 2014-08-26 22:45 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-04 08:20 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan\AppData\Local\Pokki
2015-02-03 09:05 - 2015-01-01 14:00 - 00002347 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-02-01 19:48 - 2014-08-26 22:57 - 00000000 ____D () C:\ProgramData\CyberLink
2015-02-01 19:48 - 2014-08-26 22:48 - 00000000 ____D () C:\ProgramData\Lenovo
2015-01-30 15:47 - 2014-12-14 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 21:17 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-25 15:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-24 21:20 - 2014-12-13 15:12 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2014-12-13 15:12 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-19 20:44 - 2014-08-26 22:49 - 00000000 ____D () C:\ProgramData\McAfee
2015-01-19 20:38 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-17 11:44 - 2014-08-26 22:55 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-17 11:43 - 2014-12-13 16:02 - 00000000 ____D () C:\Users\Jan\AppData\Local\Adobe
2015-01-17 11:43 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Adobe
2015-01-17 11:43 - 2014-08-26 22:55 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-17 08:23 - 2014-08-26 22:57 - 00009736 _____ () C:\WINDOWS\SysWOW64\VisualDiscovery.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\system32\VisualDiscoveryOff.ini
2015-01-14 18:50 - 2014-12-13 17:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 18:48 - 2014-12-13 17:07 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-13 19:34 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

==================== Files in the root of some directories =======

2014-08-26 22:14 - 2014-08-26 22:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Jan\AppData\Local\Temp\362270A4-3E15-7424-D959-B84C15887660.exe
C:\Users\Jan\AppData\Local\Temp\4BCD0FE7-18E4-2031-5542-49664A1ECCCD.dll
C:\Users\Jan\AppData\Local\Temp\4BCD0FE7-18E4-2031-5542-49664A1ECCCD.exe
C:\Users\Jan\AppData\Local\Temp\avgnt.exe
C:\Users\Jan\AppData\Local\Temp\Gw2.exe
C:\Users\Jan\AppData\Local\Temp\iC9FA.tmp.exe
C:\Users\Jan\AppData\Local\Temp\LenovoExperienceImprovement.exe
C:\Users\Jan\AppData\Local\Temp\oct20A0.tmp.exe
C:\Users\Jan\AppData\Local\Temp\oct9C03.tmp.exe
C:\Users\Jan\AppData\Local\Temp\octF2FE.tmp.exe
C:\Users\Jan\AppData\Local\Temp\Quarantine.exe
C:\Users\Jan\AppData\Local\Temp\SpOrder.dll
C:\Users\Jan\AppData\Local\Temp\SPSetup.exe
C:\Users\Jan\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 17:37

==================== End Of Log ============================
         
--- --- ---

--- --- ---

Alt 05.02.2015, 10:29   #5
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hi,

dann machen wir mal manuell weiter:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
BHO: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
BHO: BlockAndSurf -> {C330D4EC-AFE2-9A69-CAAD-C5E77FABCBCB} -> C:\Program Files (x86)\ver0BlockAndSurf\187_x64.dll No File
BHO-x32: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
Toolbar: HKLM - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
Toolbar: HKLM-x32 - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
C:\Program Files (x86)\pandasecuritytb\
C:\Program Files (x86)\ver0BlockAndSurf\
FF Extension: Panda Security Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [2015-02-04]
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\fftoolbar2014@etech.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\ver0BlockAndSurf\187.xpi [Not Found]
R2 serverig; C:\Users\Jan\AppData\Local\igs\IGSrv.exe [93184 2015-02-04] () [File not signed]
S1 12b083f; C:\WINDOWS\system32\drivers\12b083f.sys [76752 2014-12-13] () [File not signed]
C:\WINDOWS\system32\drivers\12b083f.sys
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 2:
Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
  • Öffne die TFC.exe.
    Vista und Win 7 User mit Rechtsklick "als Administrator starten".
  • Schließe alle anderen Programme.
  • Drücke auf den Button Start.
  • Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.



Schritt 3:
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Schritt 4:

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 5:

erstelle ein neues FRST Logfile und poste es hier (setze bitte den Haken bei adittion.txt)

__________________
Gruß Aneri
Mitglied von UNITE

Lob oder Kritik? hier wirst du es los

Alt 05.02.2015, 13:21   #6
Heitschi
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hi Aneri,
erstmal: Großartig, dass die Werbung wieder weg ist!!
Hier sind meine Logfiles:

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2015 01
Ran by Jan at 2015-02-05 10:58:14 Run:1
Running from C:\Users\Jan\Desktop\trojaner-board
Loaded Profiles: Jan (Available profiles: Jan)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
BHO: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
BHO: BlockAndSurf -> {C330D4EC-AFE2-9A69-CAAD-C5E77FABCBCB} -> C:\Program Files (x86)\ver0BlockAndSurf\187_x64.dll No File
BHO-x32: Panda Security Toolbar -> {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} -> C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
Toolbar: HKLM - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx64.dll ()
Toolbar: HKLM-x32 - Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll ()
C:\Program Files (x86)\pandasecuritytb\
C:\Program Files (x86)\ver0BlockAndSurf\
FF Extension: Panda Security Toolbar - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [2015-02-04]
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\fftoolbar2014@etech.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\ver0BlockAndSurf\187.xpi [Not Found]
R2 serverig; C:\Users\Jan\AppData\Local\igs\IGSrv.exe [93184 2015-02-04] () [File not signed]
S1 12b083f; C:\WINDOWS\system32\drivers\12b083f.sys [76752 2014-12-13] () [File not signed]
C:\WINDOWS\system32\drivers\12b083f.sys
*****************

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}" => Key deleted successfully.
"HKCR\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C330D4EC-AFE2-9A69-CAAD-C5E77FABCBCB}" => Key deleted successfully.
"HKCR\CLSID\{C330D4EC-AFE2-9A69-CAAD-C5E77FABCBCB}" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => value deleted successfully.
HKCR\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => Key not found. 
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => value deleted successfully.
HKCR\Wow6432Node\CLSID\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => Key not found. 
C:\Program Files (x86)\pandasecuritytb => Moved successfully.
"C:\Program Files (x86)\ver0BlockAndSurf" => File/Directory not found.
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} => Moved successfully.
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\fftoolbar2014@etech.com not found.
C:\Program Files (x86)\ver0BlockAndSurf\187.xpi not found.
serverig => Unable to stop service
serverig => Service deleted successfully.
12b083f => Service deleted successfully.
C:\WINDOWS\system32\drivers\12b083f.sys => Moved successfully.


The system needed a reboot. 

==== End of Fixlog 10:58:20 ====
         
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 05.02.2015
Suchlauf-Zeit: 11:25:40
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.02.05.04
Rootkit Datenbank: v2015.02.03.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Jan

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 333592
Verstrichene Zeit: 10 Min, 26 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 1
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\OptimizerMonitor.exe, 1128, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5]

Module: 8
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\OptimizerMonitorCert.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\freebl3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\libnspr4.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\libplc4.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\libplds4.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\nss3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\nssutil3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\smime3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 

Registrierungsschlüssel: 23
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\igsc, In Quarantäne, [bd1b2febb6d477bf7f29c8bbd72cfe02], 
PUP.Optional.OptimizerMonitor.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\OptimizerMonitor, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{8ACEBA70-A083-4E98-83A6-149F0CF3B840}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{13E2BC2A-7EC0-4B59-A60E-0A5043168702}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{2B127039-617D-4742-B054-5C3DEE406271}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{2ED25718-F720-4F63-B512-73AB1628D373}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6B3E15C4-8AB2-468E-8AD4-1D4601613486}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{83B3164C-ECFC-434E-92F0-713E2F0A79BD}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{84CF8797-A75F-4E60-B789-9535897EF140}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B1904DCB-AE40-4C15-9A68-23731904EF8A}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{C27698B7-82C9-4B8C-B7E8-2EB20AE594AA}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{EC05F346-7D39-424D-9141-5D7C1E1B027B}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{13E2BC2A-7EC0-4B59-A60E-0A5043168702}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{2B127039-617D-4742-B054-5C3DEE406271}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{2ED25718-F720-4F63-B512-73AB1628D373}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{6B3E15C4-8AB2-468E-8AD4-1D4601613486}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{83B3164C-ECFC-434E-92F0-713E2F0A79BD}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{84CF8797-A75F-4E60-B789-9535897EF140}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{B1904DCB-AE40-4C15-9A68-23731904EF8A}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{C27698B7-82C9-4B8C-B7E8-2EB20AE594AA}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{EC05F346-7D39-424D-9141-5D7C1E1B027B}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{8ACEBA70-A083-4E98-83A6-149F0CF3B840}, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IGS, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 

Registrierungswerte: 2
PUP.Optional.GamesDesktop.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|gmsd_de_174, In Quarantäne, [a3354cce583235016dc8701cec176898], 
PUP.Optional.OptimizerMonitor.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\OPTIMIZERMONITOR|ImagePath, C:\Program Files (x86)\IGS\OptimizerMonitor.exe, In Quarantäne, [7a5e9486375380b6c4e8196ac63d6f91]

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 2
PUP.Optional.OptimizerMonitor.A, C:\Users\Jan\AppData\Local\igs, In Quarantäne, [bd1b2febb6d477bf7f29c8bbd72cfe02], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 

Dateien: 29
PUP.Optional.RegisterOptimizerMonitor.A, C:\Program Files (x86)\IGS\RegisterOptimizerMonitor.exe, In Quarantäne, [c6121109d2b80f27c86ecb4f23df4bb5], 
PUP.Optional.RegisterOptimizerMonitor.A, C:\Program Files (x86)\IGS\RegisterOptimizerMonitor64.exe, In Quarantäne, [12c628f24842c076a19558c249b9b947], 
PUP.Optional.OptimizerMonitor.A, C:\Windows\Temp\OptimizerMonitor.log, Löschen bei Neustart, [2eaafd1def9b9a9cb2cc156e24df39c7], 
PUP.Optional.OptimizerMonitor.A, C:\Users\Jan\AppData\Local\igs\Uninstall.exe, In Quarantäne, [bd1b2febb6d477bf7f29c8bbd72cfe02], 
PUP.Optional.OptimizerMonitor.A, C:\Users\Jan\AppData\Local\igs\igrunasu.exe, In Quarantäne, [bd1b2febb6d477bf7f29c8bbd72cfe02], 
PUP.Optional.OptimizerMonitor.A, C:\Users\Jan\AppData\Local\igs\igs.exe, In Quarantäne, [bd1b2febb6d477bf7f29c8bbd72cfe02], 
PUP.Optional.OptimizerMonitor.A, C:\Users\Jan\AppData\Local\igs\IGSrv.exe, In Quarantäne, [bd1b2febb6d477bf7f29c8bbd72cfe02], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\OptimizerMonitorCert.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\freebl3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\libnspr4.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\libplc4.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\libplds4.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\nss3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\nssckbi.dll, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\nssdbm3.dll, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\nssutil3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\OptimizerMonitor.dll, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\OptimizerMonitor.exe, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\OptimizerMonitor.tlb, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\OptimizerMonitor64.dll, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\Run.exe, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\smime3.dll, Löschen bei Neustart, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\softokn3.dll, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\sqlite3.dll, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\ssl3.dll, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Program Files (x86)\IGS\uninstall.exe, In Quarantäne, [5385e13997f369cd8227582bc43f5ba5], 
PUP.Optional.OptimizerMonitor.A, C:\Windows\SysWOW64\OptimizerMonitor.ini, In Quarantäne, [696fd545147644f202a8146f4ab90bf5], 
PUP.Optional.OptimizerMonitor.A, C:\Windows\System32\OptimizerMonitorOff.ini, In Quarantäne, [4b8dc5551b6ff442bfec40431be89967], 
PUP.Optional.OptimizerMonitor.A, C:\Windows\SysWOW64\OptimizerMonitorOff.ini, In Quarantäne, [0ace8991fb8fd85e3a71acd7da29c63a], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=a089fe9391388148ba977013d541efca
# engine=22320
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-05 11:55:43
# local_time=2015-02-05 12:55:43 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Panda Cloud Antivirus'
# compatibility_mode=1552 16777213 75 93 100008 209333317 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 4657625 14015816 0 0
# scanned=198791
# found=32
# cleaned=0
# scan_time=2993
sh=7D99FBA462856BC4DD46A7B18E1D79D1C2BC0789 ft=1 fh=0c98b06ccc654f7d vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\cltmng.exe.vir"
sh=01B1F9CB2D50A5609593744320463E46B91EEED4 ft=1 fh=769d3a4457a9efb0 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPTool64.exe.vir"
sh=C91A0FA1B6D1087BFFF881365E2985A011B401C2 ft=1 fh=4fa76ddc1441696b vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32.dll.vir"
sh=FA71B8789F7BB0D1FC4A4F6EB9E082D234DD4E8A ft=1 fh=5c4c6b425e2cebc2 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32Loader.dll.vir"
sh=8FF3027FD5B24AF549A476472735F525E5A82E79 ft=1 fh=8958c815348aafc1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64.dll.vir"
sh=FED4EF394C9023B1005081D803BCB7777479CD19 ft=1 fh=d176c9757a5542b1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64Loader.dll.vir"
sh=621A43829E928D10CDA8CE4ECCF5C11E6BCFD5A8 ft=1 fh=1402f114ad354e9d vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\Main\bin\CltMngSvc.exe.vir"
sh=DDB78884545DF16760E10BFC482D1719DDCA5C90 ft=1 fh=3db9760f8b27cec5 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\Main\bin\SPTool.dll.vir"
sh=E56595B052627D2E0F79BFEB1113B85CF5E373DB ft=1 fh=fd73c4a1721c52d6 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\Main\bin\uninstall.exe.vir"
sh=1B64473A9F6DC51107678E8649727FADE9D9B4F2 ft=1 fh=d771a5c9edd3de6b vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LenovoBrowserGuard\UI\bin\cltmngui.exe.vir"
sh=62AE53143B32112CA534D4B6436D789A3624775A ft=1 fh=528b265d61225bde vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_472\mbot_de_472.exe.vir"
sh=C895B300CD6F942EC5559C0C75FC16A492E0C9A2 ft=1 fh=164a13eb639a668b vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_472\mybestofferstoday_widget.exe.vir"
sh=A7C80C4F20B091AF864EAB16ABA7190222738934 ft=1 fh=769f45ecd38982a1 vn="Win32/Adware.EoRezo Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\mbot_de_472\predm.exe.vir"
sh=C9C70752504F9DA4ECCE90EC16B2A6973E344152 ft=1 fh=70c9d98ae86ec3e3 vn="Variante von Win32/Speedchecker.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\pc speed up\PCSUSD.exe.vir"
sh=201367EB88D943210BC5A16641DFFDC79AE943E8 ft=1 fh=2e39df7ae9341275 vn="Win64/Adware.AddLyrics.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ver0BlockAndSurf\187_x64.dll.vir"
sh=8B3241690524F3EC73FFDC7643B8BD9F0828C36E ft=1 fh=c71c00110ed2bf93 vn="Variante von Win32/Adware.AddLyrics.DK Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ver0BlockAndSurf\BlockAndSurf.exe.vir"
sh=114F9F5F7EB685446DC27608522C1247E64476FD ft=1 fh=179fb43477ba434b vn="Win64/Adware.AddLyrics.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ver0BlockAndSurf\x64\TandemRunner.exe.vir"
sh=0F03517DA715FF52EC17F7D0FE3012F784D61F01 ft=1 fh=7ac2e804f6bd4ade vn="Win64/Adware.AddLyrics.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ver0BlockAndSurf\x64\webinstrNHKT.sys.vir"
sh=B4B96BE16B6B42F08E2CE8F5C2E097A8BE44BE1B ft=1 fh=65c5b8dedcacebb8 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jan\AppData\Local\mbot_de_472\upmbot_de_472.exe.vir"
sh=2A6192756BA8B0D408E5B5ACC8EFA947E594AFA7 ft=0 fh=0000000000000000 vn="Variante von Win32/Speedchecker.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jan\AppData\Local\Microsoft\Silverlight\OutOfBrowser\Speedchecker.PCSpeedUp\application.xap.vir"
sh=048EF1B93E015C66745B84738118E005472B70C8 ft=1 fh=d33b6f325258e413 vn="Win32/Adware.ConvertAd.M Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jan\AppData\Roaming\SoftwareUpdater\SoftwareUpdater.exe.vir"
sh=F4D5CDF434EC415390E4A1796A0B5146E108B215 ft=1 fh=b84895a14663e34b vn="Variante von Win32/Adware.ConvertAd.N Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jan\AppData\Roaming\SoftwareUpdater\UpdateNotifier.exe.vir"
sh=0F03517DA715FF52EC17F7D0FE3012F784D61F01 ft=1 fh=7ac2e804f6bd4ade vn="Win64/Adware.AddLyrics.H Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\WINDOWS\System32\drivers\webinstrNHKT.sys.vir"
sh=41DE1AFF8AC7BF30EA7F952825E02FA6EC6A306D ft=1 fh=cfbb424d50a0cab5 vn="Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Program Files (x86)\pandasecuritytb\dtUser.exe"
sh=30E5E6B0B58E73CADC4D59EE657E07E5AE9F5813 ft=1 fh=f84afab4951a6e89 vn="Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Program Files (x86)\pandasecuritytb\pandasecurityDx.dll"
sh=81374ADC5FD8E52504FA3E9A88C38EAA56058384 ft=1 fh=2c5c7dc7e05fe486 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Program Files (x86)\pandasecuritytb\pandasecuritytb.dll"
sh=41DE1AFF8AC7BF30EA7F952825E02FA6EC6A306D ft=1 fh=cfbb424d50a0cab5 vn="Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\dtUser.exe"
sh=EBDFE8732B0597AEF18B3BF2F3C5E377FD8BD8F6 ft=1 fh=7aba58f9a2066b22 vn="Variante von Win64/Rootkit.Kryptik.AG Trojaner" ac=I fn="C:\FRST\Quarantine\C\WINDOWS\system32\drivers\12b083f.sys.xBAD"
sh=15219C0F274C5C9956981C91ABEC5D4E3A1F6442 ft=1 fh=3fec66b3c1704bce vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Panda Security\Panda Security Protection\Tools\PandaSecurityTb.exe"
sh=B77C6E73F424C7E09D95BC34E24DD3D8BA4CD086 ft=0 fh=0000000000000000 vn="Win32/Boaxxe.BU Trojaner" ac=I fn="C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642}\components\ShellApplyProperties.js"
sh=614D9529C4AC5698BA44413ED9FF2F2AB7194030 ft=1 fh=fb5c7ba1cde5bf0c vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jan\Downloads\FREEAV1504.exe"
sh=156CCCF73C7182D7180561749602DF745F3C5B4C ft=0 fh=0000000000000000 vn="VBS/Butsur.E Wurm" ac=I fn="F:\YO.vbs"
         

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01
Ran by Jan (administrator) on LENOVO-PC-JAN on 05-02-2015 13:11:36
Running from C:\Users\Jan\Desktop
Loaded Profiles: Jan (Available profiles: Jan)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security) C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files\lenovo\Lenovo Solution Center\LSCNotify.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16.0.3327.1030_x64__8wekyb3d8bbwe\onenoteim.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-08-26] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-08-26] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [552960 2013-05-15] (Vimicro)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\RunOnce: [Application Restart #1] => C:\Users\Jan\AppData\Local\Pokki\Engine\HostAppService.exe [7846216 2015-01-31] (Pokki)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default
FF Homepage: hxxp://www.google.com/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\abs@avira.com [2015-01-19]
FF Extension: Shell Apply Properties Undo Unit - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642} [2015-01-17]
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-25]
CHR Extension: (Google Docs) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-25]
CHR Extension: (Google Drive) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-25]
CHR Extension: (YouTube) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-25]
CHR Extension: (Google-Suche) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-25]
CHR Extension: (Google Tabellen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-25]
CHR Extension: (Google Wallet) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-25]
CHR Extension: (Google Mail) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-25]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-08-26] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 panda_url_filtering; C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe [296760 2014-09-19] (Panda Security)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-25] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-11] (IDT, Inc.) [File not signed]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-08-26] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-05] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R3 panda_url_filteringd; C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys [51288 2014-03-19] (Visicom Media Inc.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1065728 2013-09-26] (Vimicro Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 11:44 - 2015-02-05 11:44 - 00010370 _____ () C:\Users\Jan\Desktop\mbam.txt
2015-02-05 11:24 - 2015-02-05 11:40 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 11:21 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-02-05 11:21 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-02-05 11:21 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-02-04 18:40 - 2015-02-05 13:09 - 00000000 ____D () C:\Users\Jan\Desktop\trojaner-board
2015-02-04 15:05 - 2015-02-04 15:08 - 00000000 ____D () C:\AdwCleaner
2015-02-04 14:59 - 2015-02-04 14:59 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\QuickScan
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-02-04 14:49 - 2015-02-04 14:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-04 10:59 - 2015-02-05 13:12 - 00018291 _____ () C:\Users\Jan\Desktop\FRST.txt
2015-02-04 10:59 - 2015-02-04 10:59 - 00036337 _____ () C:\Users\Jan\Desktop\Addition.txt
2015-02-04 10:58 - 2015-02-04 10:59 - 00041196 _____ () C:\Users\Jan\Downloads\FRST.txt
2015-02-04 10:58 - 2015-02-04 10:59 - 00036337 _____ () C:\Users\Jan\Downloads\Addition.txt
2015-02-04 10:56 - 2015-02-05 13:11 - 00000000 ____D () C:\FRST
2015-02-04 10:56 - 2015-02-05 10:57 - 02131968 _____ (Farbar) C:\Users\Jan\Desktop\FRST64.exe
2015-02-04 10:53 - 2015-02-04 10:53 - 00000468 _____ () C:\Users\Jan\Downloads\defogger_disable.log
2015-02-04 10:53 - 2015-02-04 10:53 - 00000000 _____ () C:\Users\Jan\defogger_reenable
2015-02-04 10:15 - 2015-01-29 14:22 - 00301152 _____ (OptimizerMonitor Inc.) C:\WINDOWS\SysWOW64\OptimizerMonitor.dll
2015-02-04 09:40 - 2015-02-04 09:40 - 01095584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Jan\Downloads\avira_registry_cleaner_de.exe
2015-02-04 09:05 - 2015-02-04 09:05 - 00000000 ____D () C:\OETemp
2015-02-04 08:54 - 2015-02-05 10:48 - 00000000 ____D () C:\ProgramData\panda_url_filtering
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security URL Filtering
2015-02-04 08:54 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-02-04 08:53 - 2015-02-04 08:54 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-02-04 08:52 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security
2015-02-04 08:51 - 2015-02-04 08:52 - 58043240 _____ () C:\Users\Jan\Downloads\FREEAV1504.exe
2015-02-02 17:40 - 2015-02-02 17:41 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup (1).exe
2015-02-02 17:40 - 2015-02-02 17:40 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup.exe
2015-02-02 13:27 - 2015-02-02 13:27 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\TERA
2015-02-02 13:26 - 2015-02-02 13:26 - 00000000 ____D () C:\Users\Jan\Downloads\Gameforge Live
2015-02-02 13:25 - 2015-02-02 13:25 - 20201072 _____ (Gameforge ) C:\Users\Jan\Downloads\TERA_GameforgeLiveSetup.exe
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\WebApp
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\IDT
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\CyberLink
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\CyberLink
2015-01-30 19:55 - 2015-01-30 19:55 - 00077728 _____ () C:\Users\Jan\Downloads\FLVPlayer-Chrome.exe
2015-01-28 21:01 - 2015-01-28 21:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 20:47 - 2015-01-28 20:47 - 00000000 ____D () C:\Users\Jan\Desktop\Fernuni Hagen
2015-01-25 21:08 - 2015-01-25 21:09 - 00000000 ____D () C:\Users\Jan\Desktop\Wohnungssuche
2015-01-25 20:13 - 2015-01-25 20:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-25 20:11 - 2015-02-05 12:21 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 20:11 - 2015-02-05 11:40 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-25 20:11 - 2015-02-05 11:16 - 00004118 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-25 20:11 - 2015-02-05 11:16 - 00003882 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-25 20:11 - 2015-01-25 20:13 - 00000000 ____D () C:\Users\Jan\AppData\Local\Google
2015-01-25 20:11 - 2015-01-25 20:12 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-25 20:11 - 2015-01-25 20:11 - 00880784 _____ (Google Inc.) C:\Users\Jan\Downloads\ChromeSetup.exe
2015-01-20 20:17 - 2015-01-21 22:03 - 00028672 ___SH () C:\Users\Jan\Downloads\Thumbs.db
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\ProgramData\Avira
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-01-19 19:58 - 2015-01-19 19:58 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\dlg
2015-01-18 21:01 - 2015-02-04 16:27 - 00000000 ____D () C:\Users\Jan\Desktop\Bewerbung
2015-01-18 20:21 - 2015-01-18 20:21 - 00001132 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\OpenOffice
2015-01-18 20:20 - 2015-01-18 20:20 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-18 20:07 - 2015-01-18 20:17 - 164858324 _____ () C:\Users\Jan\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2015-01-18 15:25 - 2015-01-18 15:25 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-01-17 11:43 - 2015-01-17 11:43 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-17 11:43 - 2015-01-17 11:43 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\UXmedia
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\Edtion
2015-01-17 11:34 - 2015-01-17 11:34 - 00000000 __SHD () C:\Users\Jan\AppData\Local\EmieBrowserModeList
2015-01-13 22:26 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:26 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:26 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:26 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:26 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:26 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:26 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:26 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:26 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 22:26 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-07 19:41 - 2015-01-21 21:34 - 00067072 ___SH () C:\Users\Jan\Desktop\Thumbs.db

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 13:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-05 12:37 - 2014-08-26 21:47 - 02050449 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-05 11:50 - 2013-08-22 15:46 - 00029338 _____ () C:\WINDOWS\setupact.log
2015-02-05 11:48 - 2014-08-27 07:34 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-05 11:48 - 2014-08-27 07:34 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-05 11:48 - 2014-03-18 10:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-05 11:41 - 2014-12-13 15:59 - 00000000 ___DO () C:\Users\Jan\OneDrive
2015-02-05 11:40 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-05 11:39 - 2014-08-26 22:57 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf
2015-02-05 11:39 - 2014-03-18 10:44 - 00130416 _____ () C:\WINDOWS\PFRO.log
2015-02-05 11:39 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-05 11:36 - 2014-12-13 16:01 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2872121507-3017763459-4006799705-1001
2015-02-05 10:51 - 2014-12-13 16:15 - 00003942 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DA52ABCC-602A-4952-87CC-9378739E56A8}
2015-02-04 15:08 - 2014-12-14 12:17 - 00001088 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-04 15:08 - 2014-12-13 15:55 - 00001014 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-04 15:01 - 2014-08-26 22:15 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2015-02-04 10:53 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan
2015-02-04 09:57 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Local\Packages
2015-02-04 09:08 - 2013-08-22 15:44 - 00415104 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-04 09:05 - 2014-08-26 22:59 - 00000000 ____D () C:\ProgramData\Office2013
2015-02-04 09:05 - 2014-08-26 22:45 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-04 08:20 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan\AppData\Local\Pokki
2015-02-03 09:05 - 2015-01-01 14:00 - 00002347 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-02-01 19:48 - 2014-08-26 22:57 - 00000000 ____D () C:\ProgramData\CyberLink
2015-02-01 19:48 - 2014-08-26 22:48 - 00000000 ____D () C:\ProgramData\Lenovo
2015-01-30 15:47 - 2014-12-14 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 21:17 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-25 15:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-24 21:20 - 2014-12-13 15:12 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2014-12-13 15:12 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-19 20:44 - 2014-08-26 22:49 - 00000000 ____D () C:\ProgramData\McAfee
2015-01-19 20:38 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-17 11:44 - 2014-08-26 22:55 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-17 11:43 - 2014-12-13 16:02 - 00000000 ____D () C:\Users\Jan\AppData\Local\Adobe
2015-01-17 11:43 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Adobe
2015-01-17 11:43 - 2014-08-26 22:55 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-17 08:23 - 2014-08-26 22:57 - 00009736 _____ () C:\WINDOWS\SysWOW64\VisualDiscovery.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\system32\VisualDiscoveryOff.ini
2015-01-14 18:50 - 2014-12-13 17:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 18:48 - 2014-12-13 17:07 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-13 19:34 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

==================== Files in the root of some directories =======

2014-08-26 22:14 - 2014-08-26 22:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 17:37

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2015 01
Ran by Jan at 2015-02-05 13:12:24
Running from C:\Users\Jan\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda Free Antivirus (Enabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Free Antivirus (Enabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 Lenovo Photo Master (HKLM-x32\...\InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 1.0.1823.01 - CyberLink Corp.)
 Lenovo Photo Master (x32 Version: 1.0.1823.01 - CyberLink Corp.) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
CyberLink MediaStory (HKLM-x32\...\InstallShield_{55762F9A-FCE3-45d5-817B-051218658423}) (Version: 1.0.1314 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dependency Package Update (Version: 1.6.25.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.35 - Lenovo)
Energy Manager (x32 Version: 1.0.0.35 - Lenovo) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.94 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Hightail for Lenovo (HKLM\...\{2F10E937-F6D7-4174-8AB9-B299E8FC5CEC}) (Version: 2.4.97.2857 - Hightail, Inc.)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6490.0 - IDT)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1013 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.25.00 - Lenovo Group Limited)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.13.926.1 - Vimicro)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)
Lenovo FusionEngine  (HKLM-x32\...\Lenovo FusionEngine) (Version: 1.0.13.0 - Lenovo, Inc.)
Lenovo Mobile Phone Wireless Import (HKLM-x32\...\InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}) (Version: 1.1.1.9 - Lenovo)
Lenovo Mobile Phone Wireless Import (x32 Version: 1.1.1.9 - Lenovo) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
Lenovo SHAREit (HKLM-x32\...\Lenovo SHAREit_is1) (Version: 2.0.5.0 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{4C2B6F96-3AED-4E3F-8DCE-917863D1E6B1}) (Version: 2.7.003.00 - Lenovo Group Limited)
Lenovo VeriFace (HKLM\...\Lenovo VeriFace) (Version: 5.0.13.5261 - Lenovo)
Lenovo Web Start (HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.2.53457 - Pokki)
Lenovo_Wireless_Driver (HKLM-x32\...\{5D642A72-8194-4A22-80DA-11FE610CCA8E}) (Version: 6.30.223.143 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Free Antivirus (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0000 - Panda Security)
Panda Free Antivirus (Version: 7.23.00.0000 - Panda Security) Hidden
Panda Security Toolbar (HKLM-x32\...\pandasecuritytb) (Version: 4.2.1.7 - Panda Security and Visicom Media Inc.)
Panda Security URL Filtering (HKLM-x32\...\Panda Security URL Filtering) (Version: 2.0.2.0 - Panda Security)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Start Menu (HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Pokki_Start_Menu) (Version: 0.269.5.460 - Pokki)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-02-2015 15:15:48 Geplanter Prüfpunkt
04-02-2015 14:50:38 Revo Uninstaller's restore point - BlockAndSurf

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0BCF3F50-A5B8-453D-BCCF-4400FF65F51C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-14] (Microsoft Corporation)
Task: {2096A84C-18D0-4905-99FD-E21D2BC0095A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {2EF51ED5-E206-4E25-81AB-E84D5B1B285B} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2014-12-21] (Lenovo)
Task: {5795AEA2-D68C-4F8E-A913-A125754E3F21} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: {67A8703A-F7A1-4F6B-A133-6A9906F7E542} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-10-16] ()
Task: {70362DC9-33BA-4DDF-850D-466ED3AA6A1D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: {8F617041-9525-40CD-96EE-F6238AFB5785} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-10-16] (Lenovo)
Task: {9DE7D9CD-A4FC-47F7-AA97-FA7B1D0CDD0E} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2014-05-21] ()
Task: {A14B0958-30D8-474A-AE97-99C5201D9BFA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-10-16] (Lenovo)
Task: {B9DFC9AA-5070-4376-A0F6-21F190D35869} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {CC907E5A-142A-44F7-AB66-D673E2DBDABC} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-10-16] ()
Task: {D2183EEA-BEE2-4A54-80EA-0FE8355A6B58} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {D29633D3-AC2E-44A8-9DC5-71671624E746} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2014-10-16] (Lenovo)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-08-26 22:52 - 2012-04-25 03:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-08-26 22:57 - 2014-08-26 22:57 - 00068368 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
2014-08-26 22:57 - 2014-08-26 22:57 - 00669288 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfDataStorageInterface.dll
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files (x86)\Panda Security\Panda Security Protection\SQLite3.dll
2015-02-04 09:18 - 2015-01-27 04:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libglesv2.dll
2015-02-04 09:18 - 2015-01-27 04:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libegl.dll
2015-02-04 09:18 - 2015-01-27 04:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\pdf.dll
2014-08-26 22:11 - 2013-09-04 16:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Jan\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\OptimizerMonitor => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VisualDiscovery => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jan\Pictures\sunset.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2872121507-3017763459-4006799705-500 - Administrator - Disabled)
Gast (S-1-5-21-2872121507-3017763459-4006799705-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2872121507-3017763459-4006799705-1003 - Limited - Enabled)
Jan (S-1-5-21-2872121507-3017763459-4006799705-1001 - Administrator - Enabled) => C:\Users\Jan

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/05/2015 01:05:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:53:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:52:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.


System errors:
=============
Error: (02/05/2015 11:40:34 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/05/2015 11:40:26 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126

Error: (02/05/2015 11:02:56 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/05/2015 10:59:32 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/05/2015 10:59:23 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126

Error: (02/05/2015 10:58:20 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (02/05/2015 10:57:50 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (02/04/2015 06:41:57 PM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (02/04/2015 06:41:26 PM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}

Error: (02/04/2015 04:30:53 PM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC-JAN)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}


Microsoft Office Sessions:
=========================
Error: (02/05/2015 01:05:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:53:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:52:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe


CodeIntegrity Errors:
===================================
  Date: 2015-02-04 15:09:02.267
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-04 11:08:53.875
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-04 09:42:57.460
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-04 09:08:12.502
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-01 19:53:07.337
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-30 15:47:03.494
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-30 14:50:40.882
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-20 19:50:09.519
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-19 20:43:48.681
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-17 08:22:49.231
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Percentage of memory in use: 25%
Total physical RAM: 8116.27 MB
Available physical RAM: 6058.35 MB
Total Pagefile: 16820.27 MB
Available Pagefile: 14424.07 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:889.18 GB) (Free:830.43 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.39 GB) NTFS
Drive f: (WEIBEREIEN) (Fixed) (Total:465.65 GB) (Free:351.16 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B7E5F53B)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 465.8 GB) (Disk ID: DF727AC0)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=0C)

==================== End Of Log ============================
         

Alt 05.02.2015, 13:39   #7
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Zitat:
Zitat von Heitschi Beitrag anzeigen
Hi Aneri,
erstmal: Großartig, dass die Werbung wieder weg ist!!
gut

wir sind aber noch nicht fertig...

erstmal löschen wir die Funde von ESET manuell, da sind einige dabei die nicht in der Quarantäne sind. Was mich auch noch wunder ist, dass dein Proxy wieder gesetzt ist ...

setzt du den port manuell?

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
C:\Program Files (x86)\Panda Security\Panda Security Protection\Tools\PandaSecurityTb.exe
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642}\components\ShellApplyProperties.js
C:\Users\Jan\Downloads\FREEAV1504.exe
F:\YO.vbs
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Schritt 2:

poste bitte ein frisches FRST Logfile
__________________
Gruß Aneri
Mitglied von UNITE

Lob oder Kritik? hier wirst du es los

Alt 05.02.2015, 15:45   #8
Heitschi
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Sorry, aber ich kann mit den Begriffen proxy und port nichts anfangen. Ich kenn mich echt nicht sehr gut aus...

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2015 01
Ran by Jan at 2015-02-05 15:35:50 Run:2
Running from C:\Users\Jan\Desktop
Loaded Profiles: Jan (Available profiles: Jan)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files (x86)\Panda Security\Panda Security Protection\Tools\PandaSecurityTb.exe
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642}\components\ShellApplyProperties.js
C:\Users\Jan\Downloads\FREEAV1504.exe
F:\YO.vbs
        
*****************

Could not move "C:\Program Files (x86)\Panda Security\Panda Security Protection\Tools\PandaSecurityTb.exe" => Scheduled to move on reboot.
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642}\components\ShellApplyProperties.js => Moved successfully.
C:\Users\Jan\Downloads\FREEAV1504.exe => Moved successfully.
"F:\YO.vbs" => File/Directory not found.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-02-05 15:39:36)<=

C:\Program Files (x86)\Panda Security\Panda Security Protection\Tools\PandaSecurityTb.exe => Is moved successfully.

==== End of Fixlog 15:39:36 ====
         

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01
Ran by Jan (administrator) on LENOVO-PC-JAN on 05-02-2015 15:42:15
Running from C:\Users\Jan\Desktop
Loaded Profiles: Jan (Available profiles: Jan)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security) C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16.0.3327.1030_x64__8wekyb3d8bbwe\onenoteim.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Lenovo) C:\Program Files\lenovo\Lenovo Solution Center\LSCNotify.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-08-26] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-08-26] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [552960 2013-05-15] (Vimicro)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\RunOnce: [Application Restart #1] => C:\Users\Jan\AppData\Local\Pokki\Engine\HostAppService.exe [7846216 2015-01-31] (Pokki)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default
FF Homepage: hxxp://www.google.com/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\abs@avira.com [2015-01-19]
FF Extension: Shell Apply Properties Undo Unit - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642} [2015-01-17]
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-25]
CHR Extension: (Google Docs) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-25]
CHR Extension: (Google Drive) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-25]
CHR Extension: (YouTube) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-25]
CHR Extension: (Google-Suche) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-25]
CHR Extension: (Google Tabellen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-25]
CHR Extension: (Google Wallet) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-25]
CHR Extension: (Google Mail) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-25]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-08-26] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 panda_url_filtering; C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe [296760 2014-09-19] (Panda Security)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-25] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-11] (IDT, Inc.) [File not signed]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-08-26] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-05] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R3 panda_url_filteringd; C:\ProgramData\Panda Security URL Filtering\panda_url_filteringd.sys [51288 2014-03-19] (Visicom Media Inc.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1065728 2013-09-26] (Vimicro Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 15:42 - 2015-02-05 15:42 - 00018369 _____ () C:\Users\Jan\Desktop\FRST.txt
2015-02-05 11:24 - 2015-02-05 15:39 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 11:21 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-02-05 11:21 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-02-05 11:21 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-02-04 18:40 - 2015-02-05 15:34 - 00000000 ____D () C:\Users\Jan\Desktop\trojaner-board
2015-02-04 15:05 - 2015-02-04 15:08 - 00000000 ____D () C:\AdwCleaner
2015-02-04 14:59 - 2015-02-04 14:59 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\QuickScan
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-02-04 14:49 - 2015-02-04 14:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-04 10:58 - 2015-02-04 10:59 - 00041196 _____ () C:\Users\Jan\Downloads\FRST.txt
2015-02-04 10:58 - 2015-02-04 10:59 - 00036337 _____ () C:\Users\Jan\Downloads\Addition.txt
2015-02-04 10:56 - 2015-02-05 15:42 - 00000000 ____D () C:\FRST
2015-02-04 10:56 - 2015-02-05 10:57 - 02131968 _____ (Farbar) C:\Users\Jan\Desktop\FRST64.exe
2015-02-04 10:53 - 2015-02-04 10:53 - 00000468 _____ () C:\Users\Jan\Downloads\defogger_disable.log
2015-02-04 10:53 - 2015-02-04 10:53 - 00000000 _____ () C:\Users\Jan\defogger_reenable
2015-02-04 10:15 - 2015-01-29 14:22 - 00301152 _____ (OptimizerMonitor Inc.) C:\WINDOWS\SysWOW64\OptimizerMonitor.dll
2015-02-04 09:40 - 2015-02-04 09:40 - 01095584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Jan\Downloads\avira_registry_cleaner_de.exe
2015-02-04 09:05 - 2015-02-04 09:05 - 00000000 ____D () C:\OETemp
2015-02-04 08:54 - 2015-02-05 10:48 - 00000000 ____D () C:\ProgramData\panda_url_filtering
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security URL Filtering
2015-02-04 08:54 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-02-04 08:53 - 2015-02-04 08:54 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-02-04 08:52 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security
2015-02-02 17:40 - 2015-02-02 17:41 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup (1).exe
2015-02-02 17:40 - 2015-02-02 17:40 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup.exe
2015-02-02 13:27 - 2015-02-02 13:27 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\TERA
2015-02-02 13:26 - 2015-02-02 13:26 - 00000000 ____D () C:\Users\Jan\Downloads\Gameforge Live
2015-02-02 13:25 - 2015-02-02 13:25 - 20201072 _____ (Gameforge ) C:\Users\Jan\Downloads\TERA_GameforgeLiveSetup.exe
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\WebApp
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\IDT
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\CyberLink
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\CyberLink
2015-01-30 19:55 - 2015-01-30 19:55 - 00077728 _____ () C:\Users\Jan\Downloads\FLVPlayer-Chrome.exe
2015-01-28 21:01 - 2015-01-28 21:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 20:47 - 2015-01-28 20:47 - 00000000 ____D () C:\Users\Jan\Desktop\Fernuni Hagen
2015-01-25 21:08 - 2015-01-25 21:09 - 00000000 ____D () C:\Users\Jan\Desktop\Wohnungssuche
2015-01-25 20:13 - 2015-01-25 20:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-25 20:11 - 2015-02-05 15:39 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-25 20:11 - 2015-02-05 15:21 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 20:11 - 2015-02-05 11:16 - 00004118 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-25 20:11 - 2015-02-05 11:16 - 00003882 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-25 20:11 - 2015-01-25 20:13 - 00000000 ____D () C:\Users\Jan\AppData\Local\Google
2015-01-25 20:11 - 2015-01-25 20:12 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-25 20:11 - 2015-01-25 20:11 - 00880784 _____ (Google Inc.) C:\Users\Jan\Downloads\ChromeSetup.exe
2015-01-20 20:17 - 2015-01-21 22:03 - 00028672 ___SH () C:\Users\Jan\Downloads\Thumbs.db
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\ProgramData\Avira
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-01-19 19:58 - 2015-01-19 19:58 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\dlg
2015-01-18 21:01 - 2015-02-04 16:27 - 00000000 ____D () C:\Users\Jan\Desktop\Bewerbung
2015-01-18 20:21 - 2015-01-18 20:21 - 00001132 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\OpenOffice
2015-01-18 20:20 - 2015-01-18 20:20 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-18 20:07 - 2015-01-18 20:17 - 164858324 _____ () C:\Users\Jan\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2015-01-18 15:25 - 2015-01-18 15:25 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-01-17 11:43 - 2015-01-17 11:43 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-17 11:43 - 2015-01-17 11:43 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\UXmedia
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\Edtion
2015-01-17 11:34 - 2015-01-17 11:34 - 00000000 __SHD () C:\Users\Jan\AppData\Local\EmieBrowserModeList
2015-01-13 22:26 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:26 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:26 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:26 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:26 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:26 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:26 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:26 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:26 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 22:26 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-07 19:41 - 2015-01-21 21:34 - 00067072 ___SH () C:\Users\Jan\Desktop\Thumbs.db

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 15:40 - 2014-12-13 15:59 - 00000000 __RDO () C:\Users\Jan\OneDrive
2015-02-05 15:36 - 2014-03-18 10:44 - 00131488 _____ () C:\WINDOWS\PFRO.log
2015-02-05 15:36 - 2013-08-22 15:46 - 00029454 _____ () C:\WINDOWS\setupact.log
2015-02-05 15:36 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-05 15:36 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-05 15:35 - 2014-08-26 22:57 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf
2015-02-05 15:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-05 14:27 - 2014-08-26 21:47 - 02059303 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-05 11:48 - 2014-08-27 07:34 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-05 11:48 - 2014-08-27 07:34 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-05 11:48 - 2014-03-18 10:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-05 11:36 - 2014-12-13 16:01 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2872121507-3017763459-4006799705-1001
2015-02-05 10:51 - 2014-12-13 16:15 - 00003942 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DA52ABCC-602A-4952-87CC-9378739E56A8}
2015-02-04 15:08 - 2014-12-14 12:17 - 00001088 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-04 15:08 - 2014-12-13 15:55 - 00001014 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-04 15:01 - 2014-08-26 22:15 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2015-02-04 10:53 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan
2015-02-04 09:57 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Local\Packages
2015-02-04 09:08 - 2013-08-22 15:44 - 00415104 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-04 09:05 - 2014-08-26 22:59 - 00000000 ____D () C:\ProgramData\Office2013
2015-02-04 09:05 - 2014-08-26 22:45 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-04 08:20 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan\AppData\Local\Pokki
2015-02-03 09:05 - 2015-01-01 14:00 - 00002347 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-02-01 19:48 - 2014-08-26 22:57 - 00000000 ____D () C:\ProgramData\CyberLink
2015-02-01 19:48 - 2014-08-26 22:48 - 00000000 ____D () C:\ProgramData\Lenovo
2015-01-30 15:47 - 2014-12-14 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 21:17 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-25 15:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-24 21:20 - 2014-12-13 15:12 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-24 21:20 - 2014-12-13 15:12 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-19 20:44 - 2014-08-26 22:49 - 00000000 ____D () C:\ProgramData\McAfee
2015-01-19 20:38 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-17 11:44 - 2014-08-26 22:55 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-17 11:43 - 2014-12-13 16:02 - 00000000 ____D () C:\Users\Jan\AppData\Local\Adobe
2015-01-17 11:43 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Adobe
2015-01-17 11:43 - 2014-08-26 22:55 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-17 08:23 - 2014-08-26 22:57 - 00009736 _____ () C:\WINDOWS\SysWOW64\VisualDiscovery.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\system32\VisualDiscoveryOff.ini
2015-01-14 18:50 - 2014-12-13 17:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 18:48 - 2014-12-13 17:07 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-13 19:34 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

==================== Files in the root of some directories =======

2014-08-26 22:14 - 2014-08-26 22:14 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 17:37

==================== End Of Log ============================
         
--- --- ---

--- --- ---

Alt 06.02.2015, 14:45   #9
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



ich habe dich nicht vergessen, bin nur grade am recherche betreiben und deine Logfiles am durchforsten... es geht bald weiter
__________________
Gruß Aneri
Mitglied von UNITE

Lob oder Kritik? hier wirst du es los

Alt 06.02.2015, 15:22   #10
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hi,

dann mal weiter


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [Not Found]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\ProgramData\DP45977C.lfl
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 2:

bitte erstelle ein neues FRST Logfile und poste es hier. Setze den Haken bei additions.txt
__________________
Gruß Aneri
Mitglied von UNITE

Lob oder Kritik? hier wirst du es los

Alt 07.02.2015, 08:47   #11
Heitschi
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hi Aneri, hier meine logfiles:

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2015 01
Ran by Jan at 2015-02-07 08:38:25 Run:3
Running from C:\Users\Jan\Desktop
Loaded Profiles: Jan &  (Available profiles: Jan)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [Not Found]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\ProgramData\DP45977C.lfl
         
*****************

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page => value deleted successfully.
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main\\Secondary Start Pages => value deleted successfully.
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Software\Microsoft\Internet Explorer\Main\\Default_Secondary_Page_URL => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} not found.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
Could not move "C:\ProgramData\DP45977C.lfl" => Scheduled to move on reboot.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-02-07 08:40:12)<=

"C:\ProgramData\DP45977C.lfl" => File could not move.

==== End of Fixlog 08:40:12 ====
         

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01
Ran by Jan (administrator) on LENOVO-PC-JAN on 07-02-2015 08:42:19
Running from C:\Users\Jan\Desktop
Loaded Profiles: Jan (Available profiles: Jan)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
(Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security) C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Lenovo) C:\Program Files\lenovo\Lenovo Solution Center\LSCNotify.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-08-26] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-08-26] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [552960 2013-05-15] (Vimicro)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\RunOnce: [Application Restart #1] => C:\Users\Jan\AppData\Local\Pokki\Engine\HostAppService.exe [7846216 2015-01-31] (Pokki)
ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:56888;https=127.0.0.1:56888
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default
FF Homepage: hxxp://www.google.com/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\abs@avira.com [2015-01-19]
FF Extension: Shell Apply Properties Undo Unit - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\Extensions\{146BF5E7-4201-F0C1-4B02-1E65DFF62642} [2015-01-17]
FF Extension: No Name - C:\Users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\rt5105eg.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-25]
CHR Extension: (Google Docs) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-25]
CHR Extension: (Google Drive) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-25]
CHR Extension: (YouTube) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-25]
CHR Extension: (Google-Suche) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-25]
CHR Extension: (Google Tabellen) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-25]
CHR Extension: (Google Wallet) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-25]
CHR Extension: (Google Mail) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-21] (LENOVO INCORPORATED.)
R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-08-26] (Lenovo(beijing) Limited)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 panda_url_filtering; C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filteringb.exe [296760 2014-09-19] (Panda Security)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-25] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [338944 2013-08-11] (IDT, Inc.) [File not signed]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-08-26] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [74344 2013-07-03] (Intel Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-07] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1065728 2013-09-26] (Vimicro Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-07 08:42 - 2015-02-07 08:43 - 00016511 _____ () C:\Users\Jan\Desktop\FRST.txt
2015-02-07 08:39 - 2015-02-07 08:39 - 00000000 ____H () C:\ProgramData\DP45977C.lfl
2015-02-05 11:24 - 2015-02-07 08:40 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-05 11:21 - 2015-02-05 11:21 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-05 11:21 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-02-05 11:21 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-02-05 11:21 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-02-04 18:40 - 2015-02-07 08:37 - 00000000 ____D () C:\Users\Jan\Desktop\trojaner-board
2015-02-04 15:05 - 2015-02-04 15:08 - 00000000 ____D () C:\AdwCleaner
2015-02-04 14:59 - 2015-02-04 14:59 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\QuickScan
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-02-04 14:57 - 2015-02-04 14:57 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-02-04 14:49 - 2015-02-04 14:49 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-04 10:58 - 2015-02-04 10:59 - 00041196 _____ () C:\Users\Jan\Downloads\FRST.txt
2015-02-04 10:58 - 2015-02-04 10:59 - 00036337 _____ () C:\Users\Jan\Downloads\Addition.txt
2015-02-04 10:56 - 2015-02-07 08:42 - 00000000 ____D () C:\FRST
2015-02-04 10:56 - 2015-02-05 10:57 - 02131968 _____ (Farbar) C:\Users\Jan\Desktop\FRST64.exe
2015-02-04 10:53 - 2015-02-04 10:53 - 00000468 _____ () C:\Users\Jan\Downloads\defogger_disable.log
2015-02-04 10:53 - 2015-02-04 10:53 - 00000000 _____ () C:\Users\Jan\defogger_reenable
2015-02-04 10:15 - 2015-01-29 14:22 - 00301152 _____ (OptimizerMonitor Inc.) C:\WINDOWS\SysWOW64\OptimizerMonitor.dll
2015-02-04 09:40 - 2015-02-04 09:40 - 01095584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Jan\Downloads\avira_registry_cleaner_de.exe
2015-02-04 09:05 - 2015-02-04 09:05 - 00000000 ____D () C:\OETemp
2015-02-04 08:54 - 2015-02-06 10:48 - 00000000 ____D () C:\ProgramData\panda_url_filtering
2015-02-04 08:54 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security URL Filtering
2015-02-04 08:54 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-02-04 08:53 - 2015-02-04 08:54 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Panda Security
2015-02-04 08:53 - 2015-02-04 08:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-02-04 08:52 - 2015-02-04 08:54 - 00000000 ____D () C:\ProgramData\Panda Security
2015-02-02 17:40 - 2015-02-02 17:41 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup (1).exe
2015-02-02 17:40 - 2015-02-02 17:40 - 19996360 _____ () C:\Users\Jan\Downloads\DrakensangOnlineSetup.exe
2015-02-02 13:27 - 2015-02-02 13:27 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\TERA
2015-02-02 13:26 - 2015-02-02 13:26 - 00000000 ____D () C:\Users\Jan\Downloads\Gameforge Live
2015-02-02 13:25 - 2015-02-02 13:25 - 20201072 _____ (Gameforge ) C:\Users\Jan\Downloads\TERA_GameforgeLiveSetup.exe
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\WebApp
2015-02-01 19:51 - 2015-02-01 19:51 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\IDT
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\Documents\CyberLink
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Lenovo
2015-02-01 19:48 - 2015-02-01 19:48 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\CyberLink
2015-01-30 19:55 - 2015-01-30 19:55 - 00077728 _____ () C:\Users\Jan\Downloads\FLVPlayer-Chrome.exe
2015-01-28 21:01 - 2015-01-28 21:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 20:47 - 2015-01-28 20:47 - 00000000 ____D () C:\Users\Jan\Desktop\Fernuni Hagen
2015-01-25 21:08 - 2015-01-25 21:09 - 00000000 ____D () C:\Users\Jan\Desktop\Wohnungssuche
2015-01-25 20:13 - 2015-01-25 20:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-25 20:11 - 2015-02-07 08:40 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-25 20:11 - 2015-02-07 08:35 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 20:11 - 2015-02-05 11:16 - 00004118 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-25 20:11 - 2015-02-05 11:16 - 00003882 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-25 20:11 - 2015-01-25 20:13 - 00000000 ____D () C:\Users\Jan\AppData\Local\Google
2015-01-25 20:11 - 2015-01-25 20:12 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-25 20:11 - 2015-01-25 20:11 - 00880784 _____ (Google Inc.) C:\Users\Jan\Downloads\ChromeSetup.exe
2015-01-20 20:17 - 2015-01-21 22:03 - 00028672 ___SH () C:\Users\Jan\Downloads\Thumbs.db
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\ProgramData\Avira
2015-01-19 19:59 - 2015-02-04 09:08 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-01-19 19:58 - 2015-01-19 19:58 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\dlg
2015-01-18 21:01 - 2015-02-04 16:27 - 00000000 ____D () C:\Users\Jan\Desktop\Bewerbung
2015-01-18 20:21 - 2015-01-18 20:21 - 00001132 _____ () C:\Users\Public\Desktop\OpenOffice 4.1.1.lnk
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-01-18 20:21 - 2015-01-18 20:21 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\OpenOffice
2015-01-18 20:20 - 2015-01-18 20:20 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2015-01-18 20:07 - 2015-01-18 20:17 - 164858324 _____ () C:\Users\Jan\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_de.exe
2015-01-18 15:25 - 2015-01-18 15:25 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-01-17 11:43 - 2015-01-17 11:43 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-17 11:43 - 2015-01-17 11:43 - 00002050 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\UXmedia
2015-01-17 11:34 - 2015-02-04 09:08 - 00000000 ____D () C:\Users\Jan\AppData\Local\Edtion
2015-01-17 11:34 - 2015-01-17 11:34 - 00000000 __SHD () C:\Users\Jan\AppData\Local\EmieBrowserModeList
2015-01-13 22:26 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-13 22:26 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-13 22:26 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-13 22:26 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-13 22:26 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 22:26 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-13 22:26 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-13 22:26 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-13 22:26 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-13 22:26 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-13 22:26 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 22:26 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 22:26 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 22:26 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 22:26 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-13 22:26 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-13 22:26 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-07 08:41 - 2014-12-13 15:59 - 00000000 __RDO () C:\Users\Jan\OneDrive
2015-02-07 08:39 - 2013-08-22 15:46 - 00030017 _____ () C:\WINDOWS\setupact.log
2015-02-07 08:39 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-07 08:38 - 2014-12-13 16:15 - 00003942 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DA52ABCC-602A-4952-87CC-9378739E56A8}
2015-02-07 08:38 - 2014-08-26 22:57 - 00002560 _____ () C:\WINDOWS\system32\VfService.trf
2015-02-07 08:38 - 2014-08-26 21:47 - 01331683 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-07 08:38 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-07 08:37 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-06 21:16 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-02-06 14:49 - 2014-12-13 16:01 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2872121507-3017763459-4006799705-1001
2015-02-06 09:21 - 2013-08-22 16:20 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-05 15:36 - 2014-03-18 10:44 - 00131488 _____ () C:\WINDOWS\PFRO.log
2015-02-05 11:48 - 2014-08-27 07:34 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-05 11:48 - 2014-08-27 07:34 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-05 11:48 - 2014-03-18 10:53 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-04 15:08 - 2014-12-14 12:17 - 00001088 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-04 15:08 - 2014-12-13 15:55 - 00001014 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-04 15:01 - 2014-08-26 22:15 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2015-02-04 10:53 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan
2015-02-04 09:57 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Local\Packages
2015-02-04 09:08 - 2013-08-22 15:44 - 00415104 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-04 09:05 - 2014-08-26 22:59 - 00000000 ____D () C:\ProgramData\Office2013
2015-02-04 09:05 - 2014-08-26 22:45 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-04 08:20 - 2014-12-13 15:54 - 00000000 ____D () C:\Users\Jan\AppData\Local\Pokki
2015-02-03 20:31 - 2014-12-13 15:12 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2014-12-13 15:12 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-03 09:05 - 2015-01-01 14:00 - 00002347 _____ () C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-02-01 19:48 - 2014-08-26 22:57 - 00000000 ____D () C:\ProgramData\CyberLink
2015-02-01 19:48 - 2014-08-26 22:48 - 00000000 ____D () C:\ProgramData\Lenovo
2015-01-30 15:47 - 2014-12-14 12:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-21 21:34 - 2015-01-07 19:41 - 00067072 ___SH () C:\Users\Jan\Desktop\Thumbs.db
2015-01-19 20:44 - 2014-08-26 22:49 - 00000000 ____D () C:\ProgramData\McAfee
2015-01-19 20:38 - 2013-08-22 16:36 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-01-17 11:44 - 2014-08-26 22:55 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-17 11:43 - 2014-12-13 16:02 - 00000000 ____D () C:\Users\Jan\AppData\Local\Adobe
2015-01-17 11:43 - 2014-12-13 15:55 - 00000000 ____D () C:\Users\Jan\AppData\Roaming\Adobe
2015-01-17 11:43 - 2014-08-26 22:55 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-17 08:23 - 2014-08-26 22:57 - 00009736 _____ () C:\WINDOWS\SysWOW64\VisualDiscovery.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini
2015-01-17 08:23 - 2014-08-26 22:57 - 00004776 _____ () C:\WINDOWS\system32\VisualDiscoveryOff.ini
2015-01-14 18:50 - 2014-12-13 17:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 18:48 - 2014-12-13 17:07 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-13 19:34 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

==================== Files in the root of some directories =======

2015-02-07 08:39 - 2015-02-07 08:39 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 17:37

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2015 01
Ran by Jan at 2015-02-07 08:43:11
Running from C:\Users\Jan\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda Free Antivirus (Enabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Free Antivirus (Enabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 Lenovo Photo Master (HKLM-x32\...\InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 1.0.1823.01 - CyberLink Corp.)
 Lenovo Photo Master (x32 Version: 1.0.1823.01 - CyberLink Corp.) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 20.2.1245.53580 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 20.2.1245.53580 - Alcor Micro Corp.) Hidden
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
CyberLink MediaStory (HKLM-x32\...\InstallShield_{55762F9A-FCE3-45d5-817B-051218658423}) (Version: 1.0.1314 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dependency Package Update (Version: 1.6.25.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.35 - Lenovo)
Energy Manager (x32 Version: 1.0.0.35 - Lenovo) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Hightail for Lenovo (HKLM\...\{2F10E937-F6D7-4174-8AB9-B299E8FC5CEC}) (Version: 2.4.97.2857 - Hightail, Inc.)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6490.0 - IDT)
Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1013 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3345 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.25.00 - Lenovo Group Limited)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 3.13.926.1 - Vimicro)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)
Lenovo FusionEngine  (HKLM-x32\...\Lenovo FusionEngine) (Version: 1.0.13.0 - Lenovo, Inc.)
Lenovo Mobile Phone Wireless Import (HKLM-x32\...\InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}) (Version: 1.1.1.9 - Lenovo)
Lenovo Mobile Phone Wireless Import (x32 Version: 1.1.1.9 - Lenovo) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
Lenovo SHAREit (HKLM-x32\...\Lenovo SHAREit_is1) (Version: 2.0.5.0 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{4C2B6F96-3AED-4E3F-8DCE-917863D1E6B1}) (Version: 2.7.003.00 - Lenovo Group Limited)
Lenovo VeriFace (HKLM\...\Lenovo VeriFace) (Version: 5.0.13.5261 - Lenovo)
Lenovo Web Start (HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.2.53457 - Pokki)
Lenovo_Wireless_Driver (HKLM-x32\...\{5D642A72-8194-4A22-80DA-11FE610CCA8E}) (Version: 6.30.223.143 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60310.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
Nitro Pro 9 (HKLM\...\{4C32F7E8-A65F-4D3C-9153-9F3B57CB6872}) (Version: 9.0.5.9 - Nitro)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Free Antivirus (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0000 - Panda Security)
Panda Free Antivirus (Version: 7.23.00.0000 - Panda Security) Hidden
Panda Security Toolbar (HKLM-x32\...\pandasecuritytb) (Version: 4.2.1.7 - Panda Security and Visicom Media Inc.)
Panda Security URL Filtering (HKLM-x32\...\Panda Security URL Filtering) (Version: 2.0.2.0 - Panda Security)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Start Menu (HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\...\Pokki_Start_Menu) (Version: 0.269.5.460 - Pokki)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-02-2015 15:15:48 Geplanter Prüfpunkt
04-02-2015 14:50:38 Revo Uninstaller's restore point - BlockAndSurf

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2096A84C-18D0-4905-99FD-E21D2BC0095A} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
Task: {2EF51ED5-E206-4E25-81AB-E84D5B1B285B} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2014-12-21] (Lenovo)
Task: {5795AEA2-D68C-4F8E-A913-A125754E3F21} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: {67A8703A-F7A1-4F6B-A133-6A9906F7E542} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-10-16] ()
Task: {70362DC9-33BA-4DDF-850D-466ED3AA6A1D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: {8F617041-9525-40CD-96EE-F6238AFB5785} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-10-16] (Lenovo)
Task: {9DE7D9CD-A4FC-47F7-AA97-FA7B1D0CDD0E} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2014-05-21] ()
Task: {A14B0958-30D8-474A-AE97-99C5201D9BFA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-10-16] (Lenovo)
Task: {B9DFC9AA-5070-4376-A0F6-21F190D35869} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {CC907E5A-142A-44F7-AB66-D673E2DBDABC} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-10-16] ()
Task: {D2183EEA-BEE2-4A54-80EA-0FE8355A6B58} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
Task: {D29633D3-AC2E-44A8-9DC5-71671624E746} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2014-10-16] (Lenovo)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-08-26 22:52 - 2012-04-25 03:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-08-26 22:57 - 2014-08-26 22:57 - 00068368 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
2014-08-26 22:57 - 2014-08-26 22:57 - 00669288 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfDataStorageInterface.dll
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files (x86)\Panda Security\Panda Security Protection\SQLite3.dll
2015-02-06 14:22 - 2015-02-04 10:02 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libglesv2.dll
2015-02-06 14:22 - 2015-02-04 10:02 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libegl.dll
2015-02-06 14:22 - 2015-02-04 10:02 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll
2015-02-06 14:22 - 2015-02-04 10:02 - 14965064 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\PepperFlash\pepflashplayer.dll
2014-08-26 22:11 - 2013-09-04 16:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Jan\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\OptimizerMonitor => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VisualDiscovery => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2872121507-3017763459-4006799705-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jan\Pictures\sunset.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2872121507-3017763459-4006799705-500 - Administrator - Disabled)
Gast (S-1-5-21-2872121507-3017763459-4006799705-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2872121507-3017763459-4006799705-1003 - Limited - Enabled)
Jan (S-1-5-21-2872121507-3017763459-4006799705-1001 - Administrator - Enabled) => C:\Users\Jan

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/05/2015 03:34:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 01:05:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:53:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/05/2015 11:52:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.


System errors:
=============
Error: (02/07/2015 08:39:40 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/07/2015 08:39:30 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126

Error: (02/05/2015 03:36:57 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/05/2015 03:36:45 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126

Error: (02/05/2015 01:23:51 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (02/05/2015 11:40:34 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/05/2015 11:40:26 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126

Error: (02/05/2015 11:02:56 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/05/2015 10:59:32 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/05/2015 10:59:23 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\WINDOWS\System32\bcmihvsrv64.dll
Fehlercode: 126


Microsoft Office Sessions:
=========================
Error: (02/05/2015 03:34:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\trojaner-board\esetsmartinstaller_deu.exe

Error: (02/05/2015 01:05:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:54:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:53:57 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe

Error: (02/05/2015 11:52:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Jan\Desktop\esetsmartinstaller_deu.exe


CodeIntegrity Errors:
===================================
  Date: 2015-02-04 15:09:02.267
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-04 11:08:53.875
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-04 09:42:57.460
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-04 09:08:12.502
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-01 19:53:07.337
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-30 15:47:03.494
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-30 14:50:40.882
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-20 19:50:09.519
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-19 20:43:48.681
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-01-17 08:22:49.231
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\drivers\12b083f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-4000M CPU @ 2.40GHz
Percentage of memory in use: 21%
Total physical RAM: 8116.27 MB
Available physical RAM: 6380.18 MB
Total Pagefile: 16820.27 MB
Available Pagefile: 15051.54 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:889.18 GB) (Free:830.01 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B7E5F53B)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

Alt 07.02.2015, 21:45   #12
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hi,

da haben wir eine hartnäckige Datei die sich nicht löschen lässt... kannst du bitte einmal das System im abgesicherten Modus booten und dort ein FRST Logfile erstellen?
__________________
Gruß Aneri
Mitglied von UNITE

Lob oder Kritik? hier wirst du es los

Alt 10.02.2015, 22:16   #13
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation




ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe?
Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos.

Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion möglich machen.
__________________
Gruß Aneri
Mitglied von UNITE

Lob oder Kritik? hier wirst du es los

Alt 11.02.2015, 07:28   #14
Heitschi
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



Hallo,
ich brauche in der Tat noch Hilfe. Und zwar beim booten im abgesicherten Modus. Ich habe mir die Beschreibung durchgelesen und es versucht, aber es hat nicht geklappt. Vielleicht kannst du mir noch einmal erläutern, wie ich in den abgesicherten Modus komme. Danke!

Alt 11.02.2015, 18:40   #15
Aneri
/// Malwareteam
 
Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Standard

Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation



http://www.trojaner-board.de/63335-w...s-starten.html

hilft dir das weiter?
__________________
Gruß Aneri
Mitglied von UNITE

Lob oder Kritik? hier wirst du es los

Antwort

Themen zu Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation
adware, antivir, antivirus, avira, blockiert, browser, desktop, device driver, feedback, firefox, google, homepage, iexplore.exe, installation, mozilla, newtab, programm, registry, rundll, security, software, starten, svchost.exe, system, usb, warnung, werbung, windows



Ähnliche Themen: Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation


  1. Windows 8: Ca. vor 1 Monat "continue live installation" eingefangen
    Plagegeister aller Art und deren Bekämpfung - 20.10.2015 (5)
  2. Windows 7/8: Continue Live Installation (und mehr?) eingefangen
    Plagegeister aller Art und deren Bekämpfung - 02.10.2015 (15)
  3. Continue Live Installation erscheint immer wieder...
    Log-Analyse und Auswertung - 12.04.2015 (11)
  4. Window 7 http gotut.ru lässt sich als Startseite nicht entfernen + Continue Live Installation von adwcleaner erkannt und entfernt
    Log-Analyse und Auswertung - 07.04.2015 (5)
  5. Continue live installation
    Plagegeister aller Art und deren Bekämpfung - 22.03.2015 (17)
  6. Continue Live Installation meldung
    Log-Analyse und Auswertung - 22.03.2015 (17)
  7. Continue Live Installation lässt sich nicht entfernen.
    Log-Analyse und Auswertung - 16.03.2015 (13)
  8. Continue Live Installation
    Plagegeister aller Art und deren Bekämpfung - 27.02.2015 (13)
  9. continue live installation/windows version installer bei Windows7
    Log-Analyse und Auswertung - 22.02.2015 (15)
  10. Extrem viel Werbung im Browser nach Installation aus eines Programmes aus dem Internet
    Log-Analyse und Auswertung - 22.01.2015 (22)
  11. Win7 Umbenennung Chrome Browser, Installation Continue Live Installation
    Log-Analyse und Auswertung - 01.01.2015 (11)
  12. Windows 8.1: Continue Live Installation
    Log-Analyse und Auswertung - 19.11.2014 (12)
  13. Continue Live Installation Entfernen
    Log-Analyse und Auswertung - 22.10.2014 (1)
  14. Windows 7 : Windows Version Installer Overlay und Continue Live Installation.exe verschwindet nicht.
    Log-Analyse und Auswertung - 09.10.2014 (9)
  15. Continue Live Installation
    Plagegeister aller Art und deren Bekämpfung - 02.10.2014 (17)
  16. Win7 64bit "Windows Version installer, Continue VuuPC Installation, MyPC Backup, Advanced System Protector,..."
    Log-Analyse und Auswertung - 03.07.2014 (21)
  17. Popups und Werbung im Browser Win 7 64 Bit nach Winzip Installation
    Plagegeister aller Art und deren Bekämpfung - 13.06.2014 (19)

Zum Thema Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation - Hallo, ich habe seit einiger Zeit folgende Probleme beim Surfen: a) Es taucht Werbung im Browser auf, b) Werbung wird in neuen Tabs geöffnet, c) Werbung wird in neuen Browserfenstern - Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation...
Archiv
Du betrachtest: Windows 8: Werbung im Browser/ unerwünschte Installation: Continue Live Installation auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.