Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 06.02.2015, 07:46   #1
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Icon17

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Einen guten Tag dem Forum,
Ich hatte mir gestern eine sehr agressive Suchmaschinenplage mit dem Namen
BIKINILAND im Firefox eingefangen. Dieses Bikiniland erschien auch sofort im
Chrome Browser.
Ich habe dann die Malware Bytes Software updatet und einen Suchvorgang
gestartet---- alles in Quarantäne gesetzt-----dann erfolgte ein Neustart vom
Computer-----Der Bildschirm blieb schwarz.
Das heisst: Ich kann den Computer starten-----er fährt hoch-----hat ein
wenig länger als vorher----Startbild erscheint------ klicke und kann dann
meine Zugangsdaten eingeben------er fährt langsam im Bluescreen hoch
und dann wird der Monitor schwarz.
Allerdings funktioniert der Mauszeiger und auch den Taskmanager kann ich bedienen.
Die Kacheln oder der normale Desktop erscheinen einfach nicht.
Firefox ist aktuell
Jetzt wäre ich froh um gute Tips wie ich aus diesem Dilemma wieder herauskomme
Gruss Haenschen

Alt 06.02.2015, 08:10   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Hi,

Taskmanager öffnen > Datei > Neuer Task > explorer.exe > Enter

Kommt der Desktop? Wenn nein, geht einer der abgesicherten Modi?
__________________

__________________

Alt 06.02.2015, 09:17   #3
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Daumen hoch

Vielleicht ist alles wieder OK!



Hi Schrauber,
Vielen Dank für Deine wertvolle Unterstützung!
Ich habe das "explorer.exe" ausgeführt doch es blieb schwarz auf dem Monitor.
Dann habe ich im Taskmanager die Prozesse angeschaut und sah dass
explorer.exe jetzt doppelt vorhanden ist. Nach der Methode "Ein glückliches Huhn
findet auch mal ein Korn" habe ich das explorer.exe mit der grösseren Datei gelöscht
und oh Wunder erschien der Desktop mit den Icons.
Ich hoffe dass damit mein Fall unter Vorbehalt einer längeren Testphase gelöst ist.
Besten Dank
Haenschen
__________________

Alt 06.02.2015, 10:48   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Damit sind wir erstmal nur auf dem Desktop


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 06.02.2015, 11:22   #5
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz




FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2015
Ran by Haenschen (administrator) on ROGTYTAN on 06-02-2015 11:13:27
Running from C:\Users\Haenschen\AppData\Local\Temp\7ytmm0x0.tmp
Loaded Profiles: Haenschen (Available profiles: Haenschen)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(AxoNet Software GmbH) C:\Program Files\AxoNet Software GmbH\LightsOut\LightsOutService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.exe
(Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
() C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
(ASUSTeK) C:\Program Files (x86)\ASUS\AI Suite II\Ai Charger II\AsChargerIITray.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\InstallShield Installation Information\{11F6707B-88F9-4D2D-A138-27B657BAE4D2}\AiChargerDT.exe
(ASUSTeK) C:\Program Files (x86)\ASUS\AI Suite II\Lighting\Lighting.exe
() C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\System Level Up Driver\AsSysLevelUpSrc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\5\Plugin.exe
() C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\2\Plugin.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Oracle Corporation) C:\Windows\System32\javaw.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Apple Inc.) C:\Program Files (x86)\Safari\Safari.exe
(Apple Inc.) C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7199448 2013-09-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-26] (Realtek Semiconductor Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3216032 2013-12-21] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\ASUSWSLoader.exe [63296 2013-08-16] ()
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [181208 2013-06-24] (cyberlink)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2368736 2014-06-03] (Microsoft Corp.)
HKLM-x32\...\Run: [Google Desktop Search] => C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2014-10-25] (Google)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\RunOnce: [Binkiland] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\HAENSC~1\AppData\Roaming\Binkiland\UpdateProc\bkup.dat"
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3095840 2014-10-27] (Nota Inc.)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Spotify Web Helper] => C:\Users\Haenschen\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-15] (Spotify Ltd)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30524000 2014-10-23] (Skype Technologies S.A.)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Copernic Desktop Search 4] => D:\Programme FestplD\Copernic.DesktopSearch.exe [1437456 2014-11-04] (Copernic, a division of N. Harris Computer Systems)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\RunOnce: [Binkiland] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\HAENSC~1\AppData\Roaming\Binkiland\UpdateProc\bkup.dat"
AppInit_DLLs-x32: C:\PROGRA~2\Google\GOOGLE~2\GO36F4~1.DLL => C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2014-10-25] (Google)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.ch.msn.com/
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://binkiland.com/?f=1&a=bnk_secureddownload_15_06&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0B0D0DzztB0B0E0A0D0EyEtN0D0Tzu0StCtCtAtCtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StDtByDyD0CyD0BtDtG0E0EtA0EtGzy0B0DyEtGyEtDzztAtGtB0C0AyD0BzztAyCzz0F0Dzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0EyDtCyDyBzy0FtGzy0FtCtAtGyEtB0ByBtGzyyCtD0FtGyCtB0ByBtA0DzzyB0A0DyE0B2Q&cr=1973535917&ir=
SearchScopes: HKLM -> DefaultScope {67F75E1D-8F13-41F9-82BE-78AB4EAB8A32} URL = hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_38_ff&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0B0D0DzztB0B0E0A0D0EyEtN0D0Tzu0SzyzytBtN1L2XzutAtFtBtFyEtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyE0B0DtByEzztC0DtGtAtByByDtGtByDyE0FtG0DyCyByBtGyByDtDyCzy0Dzz0B0F0DyBzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyEtCtBtDyBzytAtG0AzzyByDtGyE0EyCzytG0B0FtAzztGtC0EyDtAyEyCyBtB0F0AyB0C2Q&cr=1266261230&ir=
SearchScopes: HKLM -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = 
SearchScopes: HKLM -> {1F74105D-11F3-4A6C-9B38-02A7A9A67B38} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://binkiland.com/results.php?f=4&q={searchTerms}&a=bnk_secureddownload_15_06&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0B0D0DzztB0B0E0A0D0EyEtN0D0Tzu0StCtCtAtCtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StDtByDyD0CyD0BtDtG0E0EtA0EtGzy0B0DyEtGyEtDzztAtGtB0C0AyD0BzztAyCzz0F0Dzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0EyDtCyDyBzy0FtGzy0FtCtAtGyEtB0ByBtGzyyCtD0FtGyCtB0ByBtA0DzzyB0A0DyE0B2Q&cr=1973535917&ir=
SearchScopes: HKLM -> {67F75E1D-8F13-41F9-82BE-78AB4EAB8A32} URL = hxxp://Lasaoren.com/results.php?f=4&q={searchTerms}&a=lrn_secureddownload_14_38_ff&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0B0D0DzztB0B0E0A0D0EyEtN0D0Tzu0SzyzytBtN1L2XzutAtFtBtFyEtFtBtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyE0B0DtByEzztC0DtGtAtByByDtGtByDyE0FtG0DyCyByBtGyByDtDyCzy0Dzz0B0F0DyBzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyEtCtBtDyBzytAtG0AzzyByDtGyE0EyCzytG0B0FtAzztGtC0EyDtAyEyCyBtB0F0AyB0C2Q&cr=1266261230&ir=
SearchScopes: HKLM -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = hxxp://url24.info/?id=5225w0021d2309&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {1F74105D-11F3-4A6C-9B38-02A7A9A67B38} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {67F75E1D-8F13-41F9-82BE-78AB4EAB8A32} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=6iOYVoLA7B7YD_tMGqyXXAU5kbI?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {E7455321-3BB0-42E6-B417-028DA85C66A9} URL = https://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=523482&p={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Strong Signal -> {c723a437-2eaf-466d-a95b-3fa0966bf88c} -> C:\Program Files (x86)\Strong Signal\Extensions\c723a437-2eaf-466d-a95b-3fa0966bf88c.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: Binkiland
FF Homepage: about:home
FF Keyword.URL: https://ch.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=523482&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Programme FestplD\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3036470256-2613378711-3773960124-1002: @citrixonline.com/appdetectorplugin -> C:\Users\Haenschen\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF user.js: detected! => C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\user.js
FF Plugin ProgramFiles/Appdata: C:\Users\Haenschen\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\qwantcom.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\wikipedia-english.xml
FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\artur.dubovoy@gmail.com [2015-02-05]
FF Extension: iCloud Bookmarks - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\firefoxdav@icloud.com [2014-11-21]
FF Extension: NetVideoHunter - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\netvideohunter@netvideohunter.com [2014-12-16]
FF Extension: LastPass - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\support@lastpass.com [2014-07-10]
FF Extension: YouTube Unblocker - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\youtubeunblocker@unblocker.yt [2015-01-25]
FF Extension: DownloadHelper - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-16]
FF Extension: Cliqz Beta - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\cliqz@cliqz.com.xpi [2014-12-03]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2014-12-16]
FF Extension: Video Downloader professional - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\ffext_basicvideoext@startpage24.xpi [2014-08-31]
FF Extension: "Manage search engines" button - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\jid1-XGhxOf1M8UPpsQ@jetpack.xpi [2014-11-11]
FF Extension: Youtube Downloader - Media Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\paulsaintuzb@gmail.com.xpi [2014-08-31]
FF Extension: Top Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\tvd@link64.xpi [2014-12-16]
FF Extension: Youtube and more - Easy Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\vdpure@link64.xpi [2014-08-31]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2014-08-11]
FF Extension: ALLYouTubeDownloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\YouTubetoALL@ALLPlayer.org.xpi [2014-08-31]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2014-07-18]
FF Extension: Integrated Inbox for Gmail & Google Apps - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{28197867-b1ef-4140-8e3b-55c45b9c8460}.xpi [2014-08-12]
FF Extension: Strong Signal - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{629ac51d-702d-4c48-8a56-6d6a5061a41f}.xpi [2015-02-05]
FF Extension: NoScript - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-07-13]
FF Extension: Jordy Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{7CF39A35-6A8D-49B7-A730-9D742DC19693}.xpi [2014-12-16]
FF Extension: Easy Youtube Video Downloader Express - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi [2014-12-16]
FF Extension: Download YouTube Videos as MP4 - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2014-08-31]
FF Extension: Adblock Plus - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-11]
FF Extension: DownThemAll! - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-28]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-10-29]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [{b9aa91db-385d-4c69-8a2f-96790aa9405b}] - d:\programme festpld\firefoxconnector
FF Extension: Copernic Desktop Search - Search Firefox content - d:\programme festpld\firefoxconnector [2014-10-25]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR Profile: C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-17]
CHR Extension: (Google Drive) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-17]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23]
CHR Extension: (YouTube) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-17]
CHR Extension: (Video Downloader Classic) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdjbhfajlafdfaobjoklbamgkgcmohlm [2014-09-30]
CHR Extension: (Adblock Plus) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-17]
CHR Extension: (Copernic Desktop Search Connector) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnnbdaahphjgdgfhliignpepgnbnfomp [2014-10-27]
CHR Extension: (Google Search) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-17]
CHR Extension: (Logitech Smooth Scrolling) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2014-10-29]
CHR Extension: ( Youtube Video Downloader) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpdhnpgppfmlpaollphakolfdpbhdjol [2014-08-31]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-08-31]
CHR Extension: (Skype Click to Call) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-09-28]
CHR Extension: (Google Wallet) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-17]
CHR Extension: (Docs PDF/PowerPoint Viewer (by Google)) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn [2014-08-17]
CHR Extension: (Gmail) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-17]
CHR HKLM\...\Chrome\Extension: [ehjldlodmkdlooagebfnaghgmkfccipn] - No Path
CHR HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Chrome\Extension: [cnnbdaahphjgdgfhliignpepgnbnfomp] - d:\programme festpld\ChromeConnector\ChromeConnector.crx [2014-11-04]
CHR HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Chrome\Extension: [ehjldlodmkdlooagebfnaghgmkfccipn] - No Path
CHR HKLM-x32\...\Chrome\Extension: [ehjldlodmkdlooagebfnaghgmkfccipn] - No Path
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

Opera: 
=======
OPR Extension: (FastestTube - YouTube Video Downloader) - C:\Users\Haenschen\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag [2014-08-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2013-09-17] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe [71680 2013-08-16] (ASUS Cloud Corporation) [File not signed]
R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [35328 2013-05-07] (Realtek Semiconductor Corporation) [File not signed]
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173792 2014-06-03] (Microsoft Corp.)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [59392 2013-09-26] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [244696 2013-06-25] (CyberLink)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-24] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2014-10-25] (Google)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 LoService; C:\Program Files\AxoNet Software GmbH\LightsOut\LightsOutService.exe [19584 2013-12-19] (AxoNet Software GmbH)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 Service Mgr StrongSignal; C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.exe [549624 2015-02-05] ()
R2 Update Mgr StrongSignal; C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.exe [351992 2015-02-05] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiChargerDT; C:\Windows\SysWow64\drivers\AiChargerDT.sys [14880 2012-10-18] (ASUSTek Computer Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [469264 2013-06-26] (Intel Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-06] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2944216 2013-08-21] (Realtek Semiconductor Corporation                           )
R1 UimBus; C:\Windows\System32\drivers\UimBus.sys [102664 2014-05-19] ()
R1 Uim_DEVIM; C:\Windows\System32\drivers\uim_devim.sys [25992 2014-05-19] ()
R1 Uim_IM; C:\Windows\System32\drivers\uim_im.sys [700296 2014-05-19] ()
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 11:13 - 2015-02-06 11:13 - 00000000 ____D () C:\FRST
2015-02-06 09:31 - 2015-02-06 09:31 - 00000000 _____ () C:\Windows\WindowsUpdate.log
2015-02-05 21:12 - 2015-02-05 21:20 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Binkiland
2015-02-05 20:59 - 2015-02-06 11:00 - 00000324 _____ () C:\Windows\Tasks\Binkiland.job
2015-02-05 20:59 - 2015-02-06 07:42 - 00000000 ____D () C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce
2015-02-05 20:59 - 2015-02-05 20:59 - 00002662 _____ () C:\Windows\System32\Tasks\Binkiland
2015-02-05 20:59 - 2015-02-05 20:59 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Binkiland
2015-02-05 20:59 - 2015-02-05 20:59 - 00000000 ____D () C:\Program Files (x86)\Strong Signal
2015-02-05 20:58 - 2015-02-05 20:58 - 00000000 ____D () C:\Program Files (x86)\WSE_Binkiland
2015-02-03 22:50 - 2015-02-04 06:46 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\DriverTurbo
2015-02-03 11:11 - 2015-02-03 11:11 - 00000715 _____ () C:\Users\Haenschen\Desktop\KaraFun Player.lnk
2015-02-03 11:11 - 2015-02-03 11:11 - 00000000 ____D () C:\ProgramData\Recisio
2015-02-03 11:11 - 2015-02-03 11:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KaraFun Player
2015-02-03 11:09 - 2015-02-03 11:09 - 01191200 _____ () C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe
2015-02-03 09:35 - 2015-02-03 09:36 - 00056654 _____ () C:\Users\Haenschen\Downloads\Kontoauszug_20150203_1.zip
2015-02-02 16:10 - 2015-02-02 16:10 - 00002143 _____ () C:\Users\Haenschen\Desktop\Barchart Trader.lnk
2015-02-01 10:10 - 2015-02-01 10:10 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Image-Line
2015-01-29 15:04 - 2015-01-29 15:04 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Nitro PDF
2015-01-28 22:33 - 2015-01-28 22:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 17:50 - 2015-01-28 17:49 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-28 17:48 - 2015-01-28 17:49 - 30431144 _____ (Oracle Corporation) C:\Users\Haenschen\Downloads\jre-8u31-windows-i586.exe
2015-01-28 17:46 - 2015-01-28 17:46 - 93427112 _____ (Oracle Corporation) C:\Users\Haenschen\Downloads\jre-8u31-windows-x64.exe
2015-01-27 09:15 - 2015-01-27 09:15 - 00000796 _____ () C:\Users\Haenschen\Desktop\ASIO4ALL v2 Instruction Manual.lnk
2015-01-27 09:15 - 2015-01-27 09:15 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASIO4ALL v2
2015-01-27 09:14 - 2015-01-27 09:14 - 00000604 _____ () C:\Users\Public\Desktop\FL Studio 11 (64bit).lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000604 _____ () C:\Users\Haenschen\Desktop\FL Studio 11 (64bit).lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000592 _____ () C:\Users\Public\Desktop\FL Studio 11.lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000592 _____ () C:\Users\Haenschen\Desktop\FL Studio 11.lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files\Common Files\VST2
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files\Common Files\Propellerhead Software
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files (x86)\VstPlugins
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Users\Haenschen\Documents\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files (x86)\DSPRobotics
2015-01-27 09:05 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files (x86)\Image-Line
2015-01-18 17:56 - 2015-01-18 17:56 - 00000000 ____D () C:\Users\Haenschen\dwhelper
2015-01-16 07:01 - 2015-01-16 07:01 - 00120242 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-25.zip
2015-01-16 07:01 - 2015-01-16 07:01 - 00119874 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-38.zip
2015-01-16 07:00 - 2015-01-16 07:00 - 00120554 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-53-52.zip
2015-01-16 07:00 - 2015-01-16 07:00 - 00115565 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-9.zip
2015-01-16 06:59 - 2015-01-16 07:00 - 00115623 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-53-20.zip
2015-01-14 09:33 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 09:33 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 09:33 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-01-14 09:33 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2015-01-14 09:33 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2015-01-14 09:33 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 09:33 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 09:33 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-01-14 09:33 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2015-01-14 09:33 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2015-01-14 09:33 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-01-14 09:33 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2015-01-14 09:33 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2015-01-14 09:33 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-01-14 09:33 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-01-14 09:33 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-01-14 09:33 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-01-14 09:33 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2015-01-14 09:33 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 09:33 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-14 09:33 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-08 10:20 - 2015-01-08 10:20 - 00000000 ____D () C:\ProgramData\Gyazo

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 11:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-06 10:58 - 2014-08-17 21:37 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-06 10:51 - 2014-08-28 15:26 - 00000604 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job
2015-02-06 10:24 - 2014-07-09 18:29 - 00000000 ____D () C:\Jts
2015-02-06 09:00 - 2014-07-09 18:02 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3036470256-2613378711-3773960124-1002
2015-02-06 08:57 - 2013-12-21 05:34 - 02742364 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-06 08:57 - 2013-09-13 21:45 - 00802234 _____ () C:\Windows\system32\perfh00C.dat
2015-02-06 08:57 - 2013-09-13 21:45 - 00159184 _____ () C:\Windows\system32\perfc00C.dat
2015-02-06 08:57 - 2013-09-13 21:22 - 00765378 _____ () C:\Windows\system32\perfh007.dat
2015-02-06 08:57 - 2013-09-13 21:22 - 00159696 _____ () C:\Windows\system32\perfc007.dat
2015-02-06 08:53 - 2014-07-10 06:05 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-06 08:52 - 2014-09-30 15:58 - 00000000 ____D () C:\Users\Haenschen\OneDrive
2015-02-06 08:52 - 2014-07-09 17:57 - 00898573 _____ () C:\Users\Haenschen\AppData\Local\BTServer.log
2015-02-06 08:50 - 2014-08-17 21:37 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-06 08:50 - 2014-01-25 13:54 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-06 08:50 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-06 06:54 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-06 06:44 - 2014-07-09 18:01 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C6841A14-5519-4626-9B23-774F6AF40BEB}
2015-02-06 06:40 - 2014-11-18 15:44 - 00000000 ____D () C:\ProgramData\LightsOut
2015-02-06 06:40 - 2014-07-09 17:57 - 00000000 ____D () C:\Users\Haenschen
2015-02-05 21:33 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-02-05 21:22 - 2014-08-17 21:37 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-05 20:58 - 2014-11-11 07:28 - 10934856 _____ (LastPass) C:\Users\Haenschen\Downloads\lastpass.exe
2015-02-05 18:00 - 2014-11-14 07:50 - 00000494 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2015-02-05 17:54 - 2014-12-03 12:34 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\vlc
2015-02-04 06:53 - 2014-08-17 21:37 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-04 06:53 - 2014-08-17 21:37 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-03 22:58 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-03 20:31 - 2014-07-14 12:16 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2014-07-14 12:16 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-03 15:06 - 2014-12-05 19:47 - 00707072 ___SH () C:\Users\Haenschen\Downloads\Thumbs.db
2015-02-02 16:10 - 2014-08-13 18:17 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\JWrapper-Barchart
2015-02-02 16:10 - 2014-08-13 18:17 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\com.barchart.platform.release
2015-02-01 16:39 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-01-29 21:24 - 2014-10-19 11:00 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Spotify
2015-01-29 20:20 - 2014-10-19 11:00 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Spotify
2015-01-29 14:19 - 2014-09-01 05:48 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Adobe
2015-01-29 07:39 - 2014-12-24 11:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 17:50 - 2014-07-09 18:34 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-28 17:49 - 2014-12-22 18:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-28 17:48 - 2014-07-09 18:43 - 00000000 ____D () C:\Program Files\Java
2015-01-28 17:47 - 2014-12-22 18:12 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-01-25 17:48 - 2014-08-28 15:26 - 00003612 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002
2015-01-14 12:25 - 2014-07-11 17:54 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 12:20 - 2014-07-11 17:54 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-08 10:20 - 2014-09-29 06:20 - 00003762 _____ () C:\Windows\System32\Tasks\GyazoUpdateTaskMachine
2015-01-08 10:20 - 2014-09-29 06:19 - 00001005 _____ () C:\Users\Public\Desktop\Gyazo.lnk
2015-01-08 10:20 - 2014-09-29 06:19 - 00001005 _____ () C:\Users\Public\Desktop\Gyazo GIF.lnk
2015-01-08 10:20 - 2014-09-29 06:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gyazo
2015-01-08 10:20 - 2014-09-29 06:19 - 00000000 ____D () C:\Program Files (x86)\Gyazo

==================== Files in the root of some directories =======

2014-07-09 17:57 - 2015-02-06 08:52 - 0898573 _____ () C:\Users\Haenschen\AppData\Local\BTServer.log
2014-11-26 12:28 - 2014-11-26 12:28 - 0000831 _____ () C:\Users\Haenschen\AppData\Local\recently-used.xbel
2013-12-21 05:37 - 2013-12-21 05:37 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 11:59

==================== End Of Log ============================
         
--- --- ---






Code:
ATTFilter
scan
by
from
Mode:



Security

an

Windows
Windows

Installed

the

2.8.6
KillDisk
Digital
Flash
Reader
Suite
Micro
Micro
Software
(HKLM-x32\...\ASIO4ALL)
Easy
Music
Music
ROG
(HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B})
(x32
(HKLM-x32\...\Asus
(HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A})
(HKLM\...\CCleaner)
EAP-FAST
LEAP
PEAP
WebEx
Online
(HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1)
Desktop
Desktop
PhotoDirector
PowerDirector
PowerDirector
(x32
&amp
(HKLM-x32\...\{0C84E634-EB68-4A54-B21E-A05EC87A4CC5})
SQL
Studio
FL
(x32
Audio
PrintScreen
de
de
de
2.8.14
Desktop
Earth
Update
Update
6.4.11.2273
2.3
CL
Download
(HKLM-x32\...\ImgBurn)
Management
Network
Rapid
8
8
Player
for
for
SetPoint
Anti-Malware
Office
SkyDrive
SQL
Visual
Visual
Visual
Visual
Visual
Visual
Visual
Visual
Visual
Visual
Visual
Maker
Firefox
Maintenance
4
Reader
3D
3D
GeForce
Grafiktreiber
HD-Audiotreiber
PhysX-Systemsoftware
15
15
15
4.1.1
(HKLM-x32\...\{2C31929A-D6AB-4D0B-ABF9-4812A045CE97})
Backup
PC
3
(HKLM-x32\...\Q-Dir)
foto
Bluetooth
High
Wireless
(HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D})
2
Streaming
Click
6.22
(HKLM\...\Speccy)
(HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Spotify)
Signal
Level
Workstation
(Version:
8
media
Audio-Editor
(HKLM-x32\...\WebStorage)
Live
5.11
(HKLM-x32\...\WSE_Binkiland)
φωτογραφιών
(x32
(x32

Custom

an

HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32

Restore

12:37:04
12:15:45
07:31:38

Hosts

needed

14:25






Scheduled

an

{0E24D846-57B8-4742-AC70-60A30A39EC57}
{141DB341-3232-4F71-B294-F5C84EB332E0}
{1ABAB3FB-3468-407A-ADF3-582C7403AC54}
{285483DE-28CF-4CF1-B0DC-9A88B1682826}
{41E0ADAD-A616-4623-9444-D01B0DCB58D1}
{45260221-B342-4ACD-9861-0ED4057B3CED}
{48C009EC-8000-4631-B0ED-527C7FCB531E}
{5B3DB5D5-6D76-4F68-9C4E-EEB8B7FF4E95}
{5FB32390-8214-4F69-803D-A155FC29B660}
{6D947055-12CD-4CA2-B126-3A81E999D522}
{6EA9E01B-7B74-4FAC-9577-237F54B717DF}
{6F37BFF2-E200-46EC-B329-3E597A0608FC}
{77E3EFE9-5584-4AD7-9074-E34E5799FEB1}
{77EAA15F-BC3E-465D-BF21-ED7EFD698249}
{8CD39E1D-2BE6-41CB-A06F-822D585514D8}
{BF2239D4-DA79-4C0E-946D-B22F234C232C}
{C6D7A547-4652-4DFF-A7FB-87187B42E6E6}
{CE82311C-04AA-43B7-8EC2-15FB6EFBD4E2}
{D6C57CE6-D834-422F-BF08-938C05B2CF53}
{DDE8225B-0639-4498-B400-D0CE272E80CC}
{E36FA210-56F3-4BE4-A7F9-89C05AC3B399}
{FF168CA8-E840-4231-AFF7-FCEFF40B8CBD}
C:\Windows\Tasks\Binkiland.job
C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\ParetoLogic
C:\Windows\Tasks\ParetoLogic
C:\Windows\Tasks\PC
C:\Windows\Tasks\PC

Loaded

13:55
06:33
11:20
05:58
18:49
17:49
13:53
05:49
14:49
14:49
23:24
13:53
05:49
13:53
13:53
05:49
05:49
13:53
22:33
06:10
19:18
19:18

Alternate

an

C:\Users\Haenschen\OneDrive:ms-properties
C:\Users\Haenschen\Downloads\Ablesung

Safe

an

Err:510
Err:510

EXE

an


Other

there

Panel\Desktop\\Wallpaper

MSCONFIG/TASK

there

Err:510
Err:510
Err:510
Err:510
Err:510
Err:510

Accounts:

(S-1-5-21-3036470256-2613378711-3773960124-500
(S-1-5-21-3036470256-2613378711-3773960124-501
(S-1-5-21-3036470256-2613378711-3773960124-1002
(S-1-5-21-3036470256-2613378711-3773960124-1004

Faulty



Guid:


:
To


Event

errors:

(02/06/2015
BITSC:\Windows\System32\bitsperf.dll8

(02/06/2015
Fehler
für
Konflikt
1:
2:

(02/06/2015
Subscription

(02/05/2015
Bei

(02/05/2015
Bei

(02/05/2015
Bei

(02/05/2015
Bei

(02/05/2015
Fehler
für
Konflikt
1:
2:

(02/05/2015
Fehler
für
Konflikt
1:
2:

(02/05/2015
Das


errors:

(02/06/2015
Das

(02/06/2015
Das

(02/06/2015
Das

(02/05/2015
Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

(02/05/2015
Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

(02/05/2015
Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

(02/05/2015
Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

(02/05/2015
{1B1F472E-3221-4826-97DB-2C2324D389AE}

(02/05/2015
{4545DEA0-2DFC-4906-A728-6D986BA399A9}

(02/05/2015
{4545DEA0-2DFC-4906-A728-6D986BA399A9}


Office

(02/06/2015
BITSC:\Windows\System32\bitsperf.dll8

(02/06/2015
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program

(02/06/2015
Subscription

(02/05/2015
microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

(02/05/2015
microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

(02/05/2015
microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

(02/05/2015
microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141

(02/05/2015
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program

(02/05/2015
C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program

(02/05/2015
Windows
         

Hi Schrauber,
Es hat einen riesigen Buchstabensalat in die Dateien ausgespuckt!
Ich hoffe dass ich alles richtig gemacht habe.
Tatsächlich hat es oben noch immer Zeilen wo das BIKINILAND vorkommt.
Gruss Haenschen


Alt 06.02.2015, 14:35   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Die Addition.txt bitte noch psoten
__________________
--> Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz

Alt 06.02.2015, 15:03   #7
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Code:
ATTFilter
Additional	scan	result	of	Farbar	Recovery	Scan	Tool	(x64)	Version:	05-02-2015													
Ran	by	Haenschen	at	2015-02-06	11:14:01																		
Running	from	C:\Users\Haenschen\AppData\Local\Temp\7ytmm0x0.tmp																					
Boot	Mode:	Normal																					
Err:510																							
																							
																							
Err:510	Security	Center	Err:510																				
																							
(If	an	entry	is	included	in	the	fixlist,	it	will	be	removed.)												
																							
AV:	Windows	Defender	(Enabled	-0	Up	to	date)	{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}															
AS:	Windows	Defender	(Enabled	-0	Up	to	date)	{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}															
																							
Err:510	Installed	Programs	Err:510																				
																							
(Only	the	adware	programs	with	hidden	flag	could	be	added	to	the	fixlist	to	unhide	them.	The	adware	programs	should	be	uninstalled	manually.)	
																							
AbiWord	2.8.6	(HKLM-x32\...\AbiWord2)	(Version:	2.8.6	-0	AbiSource	Developers)																
Active@	KillDisk	9	(HKLM\...\{81B939C1-0219-42B6-A352-D5E43F2BDFAE}_is1)	(Version:	9	-0	LSoft	Technologies	Inc)														
Adobe	Digital	Editions	3	(HKLM-x32\...\Adobe	Digital	Editions	3.0)	(Version:	3.0.1	-0	Adobe	Systems	Incorporated)										
Adobe	Flash	Player	16	NPAPI	(HKLM-x32\...\Adobe	Flash	Player	NPAPI)	(Version:	16.0.0.296	-0	Adobe	Systems	Incorporated)									
Adobe	Reader	XI	(11.0.10)	-0	Deutsch	(HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001})	(Version:	11.0.10	-0	Adobe	Systems	Incorporated)											
AI	Suite	II	(HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1})	(Version:	2.04.01	-0	ASUSTeK	Computer	Inc.)														
Alcor	Micro	USB	Card	Reader	Driver	(HKLM-x32\...\AmUStor)	(Version:	20.15.6362.54439	-0	Alcor	Micro	Corp.)											
Alcor	Micro	USB	Card	Reader	Driver	(x32	Version:	20.15.6362.54439	-0	Alcor	Micro	Corp.)	Hidden										
Apple	Software	Update	(HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE})	(Version:	2.1.3.127	-0	Apple	Inc.)															
ASIO4ALL	(HKLM-x32\...\ASIO4ALL)	(Version:	2.11	Beta2	-0	Michael	Tippach)																
ASUS	Easy	Update	2	(HKLM-x32\...\{E7AA854E-6756-424E-84C2-4E47D5729AFF})	(Version:	3.00.08	-0	ASUSTeK	Computer	Inc.)													
ASUS	Music	Maker	(HKLM-x32\...\MAGIX_{AB515018-7F9D-4047-B0C0-F26BAC30F3E1})	(Version:	18.0.4.1	-0	MAGIX	AG)															
ASUS	Music	Maker	(Version:	18.0.4.1	-0	MAGIX	AG)	Hidden															
ASUS	ROG	GAMING	MOUSE	GX900	(HKLM-x32\...\{0AD3CB15-7DAA-4A0D-AD49-2BB8485C95A3})	(Version:	1.1.0	-0	ASUS)														
ASUSDVD	(HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B})	(Version:	10.0.5424.52	-0	CyberLink	Corp.)																	
ASUSDVD	(x32	Version:	10.0.5424.52	-0	CyberLink	Corp.)	Hidden																
AsusVibe2.0	(HKLM-x32\...\Asus	Vibe2.0)	(Version:	2.0.12.311	-0	ASUSTEK)																	
Bing-Desktop	(HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A})	(Version:	1.3.470.0	-0	Microsoft	Corporation)																	
CCleaner	(HKLM\...\CCleaner)	(Version:	5.01	-0	Piriform)																		
Cisco	EAP-FAST	Module	(HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9})	(Version:	2.2.14	-0	Cisco	Systems,	Inc.)														
Cisco	LEAP	Module	(HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722})	(Version:	1.0.19	-0	Cisco	Systems,	Inc.)														
Cisco	PEAP	Module	(HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F})	(Version:	1.1.6	-0	Cisco	Systems,	Inc.)														
Cisco	WebEx	Meetings	(HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\ActiveTouchMeetingClient)	(Version:		-0	Cisco	WebEx	LLC)														
Citrix	Online	Launcher	(HKLM-x32\...\{75B8A55E-0762-4676-AAC0-6FDF025B034B})	(Version:	1.0.220	-0	Citrix)																
Cliqz	(HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1)	(Version:	0.5.31	-0	Cliqz.com)																		
Copernic	Desktop	Search	4	(HKLM-x32\...\CopernicDesktopSearch4)	(Version:	4.2.0.6628	-0	Copernic)															
Copernic	Desktop	Search	4	(x32	Version:	4.2.0.6628	-0	Copernic)	Hidden														
CyberLink	PhotoDirector	3	(HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10})	(Version:	3.0.4428	-0	CyberLink	Corp.)															
CyberLink	PowerDirector	10	(HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32})	(Version:	10.0.0.2810	-0	CyberLink	Corp.)															
CyberLink	PowerDirector	10	(Version:	10.0.0.2810	-0	CyberLink	Corp.)	Hidden															
D3DX10	(x32	Version:	15.4.2368.0902	-0	Microsoft)	Hidden																	
Download	&amp		Install	Packages	(HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Download	&amp		Install	Packages)	(Version:		-0	)	<====	ATTENTION								
eManual	(HKLM-x32\...\{0C84E634-EB68-4A54-B21E-A05EC87A4CC5})	(Version:	1.00.07	-0	ASUSTeK	Computer	Inc.)																
Firebird	SQL	Server	-0	MAGIX	Edition	(HKLM-x32\...\{39AB2E37-1A55-4292-A5D3-971E9F70D0F8})	(Version:	2.1.32.0	-0	MAGIX	AG)												
FL	Studio	11	(HKLM-x32\...\FL	Studio	11)	(Version:		-0	Image-Line)														
FlowStone	FL	3	(HKLM-x32\...\FlowStone)	(Version:		-0	)																
Fotogalerie	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden																
Free	Audio	Converter	version	5.0.52.1107	(HKLM-x32\...\Free	Audio	Converter_is1)	(Version:	5.0.52.1107	-0	DVDVideoSoft	Ltd.)											
Gadwin	PrintScreen	(64-Bit)	(HKLM\...\{C4E9434D-9FA7-4D27-9805-D767A8A38904})	(Version:	5.4.0.0	-0	Gadwin	Systems)															
Galeria	de	Fotografias	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden														
Galería	de	fotos	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden														
Galerie	de	photos	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden														
GIMP	2.8.14	(HKLM\...\GIMP-2_is1)	(Version:	2.8.14	-0	The	GIMP	Team)															
Google	Desktop	(HKLM-x32\...\Google	Desktop)	(Version:	5.9.1005.12335	-0	Google)																
Google	Earth	(HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E})	(Version:	7.1.2.2041	-0	Google)																	
Google	Update	Helper	(x32	Version:	1.3.25.11	-0	Google	Inc.)	Hidden														
Google	Update	Helper	(x32	Version:	1.3.26.9	-0	Google	Inc.)	Hidden														
GoToMeeting	6.4.11.2273	(HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\GoToMeeting)	(Version:	6.4.11.2273	-0	CitrixOnline)																	
Gyazo	2.3	(HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1)	(Version:		-0	Nota	Inc.)																
hotComm®	CL	(HKLM-x32\...\hotComm®	CL)	(Version:	8.00.012x	-0	1stWorks	Corporation)															
IL	Download	Manager	(HKLM-x32\...\IL	Download	Manager)	(Version:		-0	Image-Line)														
ImgBurn	(HKLM-x32\...\ImgBurn)	(Version:	2.5.8.0	-0	LIGHTNING	UK!)																	
Intel(R)	Management	Engine	Components	(HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A})	(Version:	9.5.14.1724	-0	Intel	Corporation)														
Intel(R)	Network	Connections	18.5.54.0	(HKLM\...\PROSetDX)	(Version:	18.5.54.0	-0	Intel)															
Intel(R)	Rapid	Storage	Technology	(HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140})	(Version:	12.8.0.1016	-0	Intel	Corporation)														
Java	8	Update	31	(64-bit)	(HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0})	(Version:	8.0.310	-0	Oracle	Corporation)													
Java	8	Update	31	(HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0})	(Version:	8.0.310	-0	Oracle	Corporation)														
KaraFun	Player	(HKLM-x32\...\KaraFun	Player_is1)	(Version:	1.20.86.771	-0	Recisio)																
Lights-Out	for	Windows	8	(HKLM-x32\...\Lights-Out	for	Windows	8)	(Version:	1.5.5.2136	-0	AxoNet	Software	GmbH)										
Lights-Out	for	Windows	8	(Version:	1.5.5.2136	-0	AxoNet	Software	GmbH)	Hidden													
Logitech	SetPoint	6.65	(HKLM\...\sp6)	(Version:	6.65.62	-0	Logitech)																
Malwarebytes	Anti-Malware	Version	2.0.4.1028	(HKLM-x32\...\Malwarebytes	Anti-Malware_is1)	(Version:	2.0.4.1028	-0	Malwarebytes	Corporation)													
Microsoft	Office	365	-0	de-de	(HKLM\...\O365HomePremRetail	-0	de-de)	(Version:	15.0.4675.1003	-0	Microsoft	Corporation)											
Microsoft	SkyDrive	(HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\SkyDriveSetup.exe)	(Version:	16.4.6013.0910	-0	Microsoft	Corporation)																
Microsoft	SQL	Server	2005	Compact	Edition	[ENU]	(HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8})	(Version:	3.1.0000	-0	Microsoft	Corporation)											
Microsoft	Visual	C++	2005	Redistributable	(HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c})	(Version:	8.0.59193	-0	Microsoft	Corporation)													
Microsoft	Visual	C++	2008	Redistributable	-0	x64	9.0.30729.17	(HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE})	(Version:	9.0.30729	-0	Microsoft	Corporation)										
Microsoft	Visual	C++	2008	Redistributable	-0	x64	9.0.30729.4148	(HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6})	(Version:	9.0.30729.4148	-0	Microsoft	Corporation)										
Microsoft	Visual	C++	2008	Redistributable	-0	x64	9.0.30729.6161	(HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4})	(Version:	9.0.30729.6161	-0	Microsoft	Corporation)										
Microsoft	Visual	C++	2008	Redistributable	-0	x86	9.0.21022	(HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4})	(Version:	9.0.21022	-0	Microsoft	Corporation)										
Microsoft	Visual	C++	2008	Redistributable	-0	x86	9.0.30729.17	(HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475})	(Version:	9.0.30729	-0	Microsoft	Corporation)										
Microsoft	Visual	C++	2008	Redistributable	-0	x86	9.0.30729.4148	(HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989})	(Version:	9.0.30729.4148	-0	Microsoft	Corporation)										
Microsoft	Visual	C++	2008	Redistributable	-0	x86	9.0.30729.6161	(HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F})	(Version:	9.0.30729.6161	-0	Microsoft	Corporation)										
Microsoft	Visual	C++	2010		x64	Redistributable	-0	10.0.40219	(HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7})	(Version:	10.0.40219	-0	Microsoft	Corporation)									
Microsoft	Visual	C++	2010		x86	Redistributable	-0	10.0.40219	(HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5})	(Version:	10.0.40219	-0	Microsoft	Corporation)									
Microsoft	Visual	C++	2012	Redistributable	(x64)	-0	11.0.51106	(HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07})	(Version:	11.0.51106.1	-0	Microsoft	Corporation)										
Movie	Maker	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden															
Mozilla	Firefox	35.0.1	(x86	de)	(HKLM-x32\...\Mozilla	Firefox	35.0.1	(x86	de))	(Version:	35.0.1	-0	Mozilla)										
Mozilla	Maintenance	Service	(HKLM-x32\...\MozillaMaintenanceService)	(Version:	34.0.5	-0	Mozilla)																
MSXML	4	SP3	Parser	(HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94})	(Version:	4.30.2100.0	-0	Microsoft	Corporation)														
Nitro	Reader	3	(HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB})	(Version:	3.5.6.5	-0	Nitro)																
NVIDIA	3D	Vision	Controller-Treiber	340.5	(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB)	(Version:	340.5	-0	NVIDIA	Corporation)													
NVIDIA	3D	Vision	Treiber	326.6	(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision)	(Version:	326.6	-0	NVIDIA	Corporation)													
NVIDIA	GeForce	Experience	2.1.1	(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience)	(Version:	2.1.1	-0	NVIDIA	Corporation)														
NVIDIA	Grafiktreiber	326.6	(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver)	(Version:	326.6	-0	NVIDIA	Corporation)															
NVIDIA	HD-Audiotreiber	1.3.30.1	(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver)	(Version:	1.3.30.1	-0	NVIDIA	Corporation)															
NVIDIA	PhysX-Systemsoftware	9.13.1220	(HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX)	(Version:	9.13.1220	-0	NVIDIA	Corporation)															
Office	15	Click-to-Run	Extensibility	Component	(x32	Version:	15.0.4675.1003	-0	Microsoft	Corporation)	Hidden												
Office	15	Click-to-Run	Licensing	Component	(Version:	15.0.4675.1003	-0	Microsoft	Corporation)	Hidden													
Office	15	Click-to-Run	Localization	Component	(x32	Version:	15.0.4675.1003	-0	Microsoft	Corporation)	Hidden												
OpenOffice	4.1.1	(HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602})	(Version:	4.11.9775	-0	Apache	Software	Foundation)															
OptionsOracle	(HKLM-x32\...\{2C31929A-D6AB-4D0B-ABF9-4812A045CE97})	(Version:	1.6	-0	SamoaSky)																		
Paragon	Backup	and	Recovery™	2014	Free	(HKLM\...\{C268B5E1-A5DA-11DF-A289-005056C00008})	(Version:	90.00.0003	-0	Paragon	Software)												
ParetoLogic	PC	Health	Advisor	(HKLM-x32\...\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E})	(Version:	3.1.0.0	-0	ParetoLogic,	Inc.)														
Picasa	3	(HKLM-x32\...\Picasa	3)	(Version:	3.9	-0	Google,	Inc.)															
Q-Dir	(HKLM-x32\...\Q-Dir)	(Version:		-0	)																		
Raccolta	foto	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden															
REALTEK	Bluetooth	Driver	(HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB})	(Version:	3.769.769.092613	-0	REALTEK	Semiconductor	Corp.)														
Realtek	High	Definition	Audio	Driver	(HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC})	(Version:	6.0.1.7035	-0	Realtek	Semiconductor	Corp.)												
REALTEK	Wireless	LAN	Driver	(HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5})	(Version:	1.00.0224	-0	REALTEK	Semiconductor	Corp.)													
Safari	(HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D})	(Version:	5.34.57.2	-0	Apple	Inc.)																	
SaxoTrader	2	(HKLM-x32\...\{024D66E9-D50C-44A7-92B4-2DFDDD95D228})	(Version:	2.110.25.0	-0	Saxo	Bank)																
SHIELD	Streaming	(Version:	3.1.100	-0	NVIDIA	Corporation)	Hidden																
Skype	Click	to	Call	(HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701})	(Version:	7.3.16540.9015	-0	Microsoft	Corporation)														
Skype™	6.22	(HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7})	(Version:	6.22.104	-0	Skype	Technologies	S.A.)															
Speccy	(HKLM\...\Speccy)	(Version:	1.26	-0	Piriform)																		
Spotify	(HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Spotify)	(Version:	0.9.15.27.g87efe634	-0	Spotify	AB)																	
Strong	Signal	(HKLM-x32\...\Strong	Signal)	(Version:	2.0.5514.19469	-0	Strong	Signal)															
System	Level	Up	Driver	(HKLM-x32\...\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355})	(Version:	2.02.01	-0	ASUSTeK	Computer	Inc.)													
Trader	Workstation	4	(HKLM-x32\...\Trader	Workstation	4.0)	(Version:		-0	)														
VC_CRT_x64	(Version:	1.02.0000	-0	Intel	Corporation)	Hidden																	
VirtualDJ	8	(HKLM-x32\...\{9ADBBA93-4625-4898-BB0D-BCE7EA9F8B4A})	(Version:	8.0.0	-0	Atomix	Productions)																
VLC	media	player	(HKLM\...\VLC	media	player)	(Version:	2.1.5	-0	VideoLAN)														
WavePad	Audio-Editor	(HKLM-x32\...\WavePad)	(Version:	5.91	-0	NCH	Software)																
WebStorage	(HKLM-x32\...\WebStorage)	(Version:	2.0.3.226	-0	ASUS	Cloud	Corporation)																
Windows	Live	Essentials	(HKLM-x32\...\WinLiveSuite)	(Version:	16.4.3508.0205	-0	Microsoft	Corporation)															
WinRAR	5.11	(64-Bit)	(HKLM\...\WinRAR	archiver)	(Version:	5.11.0	-0	win.rar	GmbH)														
WSE_Binkiland	(HKLM-x32\...\WSE_Binkiland)	(Version:		-0	WSE_Binkiland)																		
Συλλογή	φωτογραφιών	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden															
影像中心	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden																
照片库	(x32	Version:	16.4.3508.0205	-0	Microsoft	Corporation)	Hidden																
																							
Err:510	Custom	CLSID	(selected	items):	Err:510																		
																							
(If	an	entry	is	included	in	the	fixlist,	it	will	be	removed	from	registry.	Any	eventual	file	will	not	be	moved.)			
																							
CustomCLSID:	HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32	->	C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\1468\G2MOutlookAddin64.dll	(Citrix	Online,	a	division	of	Citrix	Systems,	Inc.)												
CustomCLSID:	HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	->	C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll	(Microsoft	Corporation)																		
CustomCLSID:	HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	->	C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll	(Microsoft	Corporation)																		
CustomCLSID:	HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	->	C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll	(Microsoft	Corporation)																		
CustomCLSID:	HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32	->	C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll	(Microsoft	Corporation)																		
																							
Err:510	Restore	Points		Err:510																			
																							
21-01-2015	12:37:04	Geplanter	Prüfpunkt																				
28-01-2015	12:15:45	Windows	Update																				
05-02-2015	07:31:38	Geplanter	Prüfpunkt																				
																							
Err:510	Hosts	content:	Err:510																				
																							
(If	needed	Hosts:	directive	could	be	included	in	the	fixlist	to	reset	Hosts.)											
																							
2013-08-22	14:25	-0	2014-12-22	22:35	-0	940	____A	C:\Windows\system32\Drivers\etc\hosts															
255.255.255.255	hcurltest5																							
255.255.255.255	vnsjs1.1stworks.com																							
76.74.166.147	hcurltest2																							
74.208.77.54	hcurltest1																							
																							
																							
Err:510	Scheduled	Tasks	(whitelisted)	Err:510																			
																							
(If	an	entry	is	included	in	the	fixlist,	it	will	be	removed	from	registry.	Any	associated	file	could	be	listed	separately	to	be	moved.)
																							
Task:	{0E24D846-57B8-4742-AC70-60A30A39EC57}	-0	System32\Tasks\AsusVibeSchedule	Err:510	C:\Program	Files	(x86)\Asus\AsusVibe\AsusVibeLauncher.exe	[2013-11-05]	()														
Task:	{141DB341-3232-4F71-B294-F5C84EB332E0}	-0	System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB	Err:510	C:\Windows\system32\MRT.exe	[2015-01-14]	(Microsoft	Corporation)															
Task:	{1ABAB3FB-3468-407A-ADF3-582C7403AC54}	-0	System32\Tasks\Adobe	Acrobat	Update	Task	Err:510	C:\Program	Files	(x86)\Common	Files\Adobe\ARM\1.0\AdobeARM.exe	[2014-12-19]	(Adobe	Systems	Incorporated)								
Task:	{285483DE-28CF-4CF1-B0DC-9A88B1682826}	-0	System32\Tasks\ASUS\ASUS	AI	Suite	II	Execute	Err:510	C:\Program	Files	(x86)\ASUS\AI	Suite	II\AsRoutineController.exe	[2012-03-13]	(ASUSTeK	Computer	Inc.)						
Task:	{41E0ADAD-A616-4623-9444-D01B0DCB58D1}	-0	System32\Tasks\ParetoLogic	Update	Version3	Err:510	C:\Program	Files	(x86)\Common	Files\ParetoLogic\UUS3\Pareto_Update3.exe	[2011-03-30]	(ParetoLogic	Inc.)										
Task:	{45260221-B342-4ACD-9861-0ED4057B3CED}	-0	System32\Tasks\ASUS\ASUS	AiCharger_II	TrayIcon	Err:510	C:\Program	Files	(x86)\ASUS\AI	Suite	II\Ai	Charger	II\AsChargerIITray.exe	[2013-06-05]	(ASUSTeK)								
Task:	{48C009EC-8000-4631-B0ED-527C7FCB531E}	-0	System32\Tasks\Binkiland	Err:510	C:\Users\Haenschen\AppData\Roaming\Binkiland\UpdateProc\UpdateTask.exe	[2015-02-05]	()	<====	ATTENTION														
Task:	{5B3DB5D5-6D76-4F68-9C4E-EEB8B7FF4E95}	-0	System32\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002	Err:510	C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe	[2015-01-25]	(Citrix	Online,	a	division	of	Citrix	Systems,	Inc.)									
Task:	{5FB32390-8214-4F69-803D-A155FC29B660}	-0	System32\Tasks\ASUS\AsSysLevelUpSrc	Err:510	C:\Program	Files\ASUS\System	Level	Up	Driver\AsSysLevelUpSrc.exe	[2013-05-14]	(ASUSTeK	Computer	Inc.)										
Task:	{6D947055-12CD-4CA2-B126-3A81E999D522}	-0	System32\Tasks\GoogleUpdateTaskMachineUA	Err:510	C:\Program	Files	(x86)\Google\Update\GoogleUpdate.exe	[2014-08-17]	(Google	Inc.)													
Task:	{6EA9E01B-7B74-4FAC-9577-237F54B717DF}	-0	System32\Tasks\Microsoft\Office\Office	Automatic	Updates	Err:510	C:\Program	Files\Microsoft	Office	15\ClientX64\OfficeC2RClient.exe	[2014-11-04]	(Microsoft	Corporation)										
Task:	{6F37BFF2-E200-46EC-B329-3E597A0608FC}	-0	System32\Tasks\ASUS\ASUS	Easy	Update	2	Err:510	C:\Program	Files	(x86)\ASUS\ASUS	Easy	Update\ALU.exe	[2013-07-05]	(ASUSTeK	Computer	Inc.)							
Task:	{77E3EFE9-5584-4AD7-9074-E34E5799FEB1}	-0	System32\Tasks\PC	Health	Advisor	Defrag	Err:510	D:\Programme	FestplD\PCHA\PCHA.exe	[2011-03-30]	(ParetoLogic,	Inc.)											
Task:	{77EAA15F-BC3E-465D-BF21-ED7EFD698249}	-0	System32\Tasks\PC	Health	Advisor	Err:510	D:\Programme	FestplD\PCHA\PCHA.exe	[2011-03-30]	(ParetoLogic,	Inc.)												
Task:	{8CD39E1D-2BE6-41CB-A06F-822D585514D8}	-0	System32\Tasks\ParetoLogic	Registration3	Err:510	Rundll32.exe	C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll	RunUns															
Task:	{BF2239D4-DA79-4C0E-946D-B22F234C232C}	-0	System32\Tasks\GoogleUpdateTaskMachineCore	Err:510	C:\Program	Files	(x86)\Google\Update\GoogleUpdate.exe	[2014-08-17]	(Google	Inc.)													
Task:	{C6D7A547-4652-4DFF-A7FB-87187B42E6E6}	-0	System32\Tasks\CCleanerSkipUAC	Err:510	C:\Program	Files\CCleaner\CCleaner.exe	[2014-12-12]	(Piriform	Ltd)														
Task:	{CE82311C-04AA-43B7-8EC2-15FB6EFBD4E2}	-0	System32\Tasks\Microsoft\Office\Office	Subscription	Maintenance	Err:510	C:\Program	Files\Microsoft	Office	15\root\vfs\ProgramFilesCommonx86\Microsoft	Shared\OFFICE15\OLicenseHeartbeat.exe	[2014-11-12]	(Microsoft	Corporation)									
Task:	{D6C57CE6-D834-422F-BF08-938C05B2CF53}	-0	System32\Tasks\GyazoUpdateTaskMachine	Err:510	C:\Program	Files	(x86)\Gyazo\GyazoUpdate.exe	[2014-07-03]	()														
Task:	{DDE8225B-0639-4498-B400-D0CE272E80CC}	-0	System32\Tasks\ASUS\ASUS	AiCharger_Desktop	Execute	Err:510	C:\Program	Files	(x86)\InstallShield	Installation	Information\{11F6707B-88F9-4D2D-A138-27B657BAE4D2}\AiChargerDT.exe	[2013-05-17]	(ASUSTek	Computer	Inc.)								
Task:	{E36FA210-56F3-4BE4-A7F9-89C05AC3B399}	-0	System32\Tasks\ASUS\ASUS	Lighting	Execute	Err:510	C:\Program	Files	(x86)\ASUS\AI	Suite	II\Lighting\Lighting.exe	[2013-04-13]	(ASUSTeK)										
Task:	{FF168CA8-E840-4231-AFF7-FCEFF40B8CBD}	-0	System32\Tasks\ASUS\SystemLevelUp	Driver	Err:510	C:\Program	Files\ASUS\System	Level	Up	Driver\SysLevelUp.exe	[2013-04-10]	()											
Task:	C:\Windows\Tasks\Binkiland.job	Err:510	C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE	<====	ATTENTION																		
Task:	C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job	Err:510	C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe																				
Task:	C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job	Err:510	C:\Program	Files	(x86)\Google\Update\GoogleUpdate.exe																		
Task:	C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job	Err:510	C:\Program	Files	(x86)\Google\Update\GoogleUpdate.exe																		
Task:	C:\Windows\Tasks\ParetoLogic	Registration3.job	Err:510	C:\Program	Files	(x86)\Common	Files\ParetoLogic\UUS3\UUS3.dll																
Task:	C:\Windows\Tasks\ParetoLogic	Update	Version3.job	Err:510	C:\Program	Files	(x86)\Common	Files\ParetoLogic\UUS3\Pareto_Update3.exe															
Task:	C:\Windows\Tasks\PC	Health	Advisor	Defrag.job	Err:510	D:\Programme	FestplD\PCHA\PCHA.exe																
Task:	C:\Windows\Tasks\PC	Health	Advisor.job	Err:510	D:\Programme	FestplD\PCHA\PCHA.exe																	
																							
Err:510	Loaded	Modules	(whitelisted)	Err:510																			
																							
2014-01-25	13:55	-0	2013-09-26	19:15	-0	59392	_____	()	C:\Program	Files	(x86)\REALTEK\Realtek	Bluetooth\BTDevMgr.exe											
2014-08-05	06:33	-0	2014-05-20	08:19	-0	105640	_____	()	C:\Program	Files\Microsoft	Office	15\ClientX64\ApiClient.dll											
2013-12-19	11:20	-0	2013-12-19	11:20	-0	75904	_____	()	C:\Program	Files\AxoNet	Software	GmbH\LightsOut\AxoNet.LightsOut.CommonTypes.W78.XmlSerializers.dll											
2013-12-21	05:58	-0	2012-04-24	11:43	-0	390632	____R	()	C:\Program	Files\CyberLink\Shared	files\RichVideo64.exe												
2015-02-05	18:49	-0	2015-02-05	22:32	-0	549624	_____	()	C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.exe														
2015-02-05	17:49	-0	2015-02-05	21:32	-0	351992	_____	()	C:\Program	Files	(x86)\Common	Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.exe											
2014-01-25	13:53	-0	2013-04-10	05:28	-0	3078016	_____	()	C:\Program	Files\ASUS\System	Level	Up	Driver\SysLevelUp.exe										
2013-12-21	05:49	-0	2012-06-01	10:42	-0	920736	____R	()	C:\Program	Files	(x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe												
2015-02-05	14:49	-0	2015-02-05	14:49	-0	518904	_____	()	C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\5\plugin.exe														
2015-02-05	14:49	-0	2015-02-05	14:49	-0	1132792	_____	()	C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\2\plugin.exe														
2014-12-12	23:24	-0	2014-12-12	23:24	-0	47104	_____	()	C:\Program	Files\CCleaner\lang\lang-1031.dll													
2014-01-25	13:53	-0	2013-04-10	05:28	-0	475136	_____	()	C:\Program	Files\ASUS\System	Level	Up	Driver\HookKey32.dll										
2013-12-21	05:49	-0	2012-11-23	01:14	-0	50688	_____	()	C:\Program	Files	(x86)\ASUS\ASUS	Easy	Update\AsMultiLang.dll										
2014-01-25	13:53	-0	2013-04-10	05:28	-0	179712	_____	()	C:\Program	Files\ASUS\System	Level	Up	Driver\ASUSSERVICE.DLL										
2014-01-25	13:53	-0	2013-04-10	05:28	-0	609280	_____	()	C:\Program	Files\ASUS\System	Level	Up	Driver\DeskTopToastDll.dll										
2013-12-21	05:49	-0	2015-02-06	08:50	-0	29696	_____	()	C:\Program	Files	(x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll												
2013-12-21	05:49	-0	2010-06-29	03:58	-0	104448	____R	()	C:\Program	Files	(x86)\ASUS\AXSP\1.00.19\ATKEX.dll												
2014-01-25	13:53	-0	2013-09-04	01:52	-0	1242584	_____	()	C:\Program	Files	(x86)\Intel\Intel(R)	Management	Engine	Components\LMS\ACE.dll									
2015-01-28	22:33	-0	2015-01-28	22:33	-0	3925104	_____	()	C:\Program	Files	(x86)\Mozilla	Firefox\mozjs.dll											
2014-07-10	06:10	-0	2014-07-10	06:10	-0	1020928	_____	()	C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll														
2012-04-24	19:18	-0	2012-04-24	19:18	-0	1242472	_____	()	C:\Program	Files	(x86)\Safari\Apple	Application	Support\libxml2.dll										
2012-04-24	19:18	-0	2012-04-24	19:18	-0	87912	_____	()	C:\Program	Files	(x86)\Safari\Apple	Application	Support\zlib1.dll										
																							
Err:510	Alternate	Data	Streams	(whitelisted)	Err:510																		
																							
(If	an	entry	is	included	in	the	fixlist,	only	the	Alternate	Data	Streams	will	be	removed.)								
																							
AlternateDataStreams:	C:\Users\Haenschen\OneDrive:ms-properties																						
AlternateDataStreams:	C:\Users\Haenschen\Downloads\Ablesung	per	09.01.2014.eml:OECustomProperty																				
																							
Err:510	Safe	Mode	(whitelisted)	Err:510																			
																							
(If	an	item	is	included	in	the	fixlist,	it	will	be	removed	from	the	registry.	The	AlternateShell	will	be	restored.)				
																							
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc	Err:510																						
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc	Err:510																						
																							
Err:510	EXE	Association	(whitelisted)	Err:510																			
																							
(If	an	entry	is	included	in	the	fixlist,	the	default	will	be	restored.	None	default	entries	will	be	removed.)					
																							
																							
Err:510	Other	Registry	Areas	Err:510																			
																							
(Currently	there	is	no	automatic	fix	for	this	section.)															
																							
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Control	Panel\Desktop\\Wallpaper	->	C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper																				
																							
Err:510	MSCONFIG/TASK	MANAGER	disabled	items	Err:520																		
																							
(Currently	there	is	no	automatic	fix	for	this	section.)															
																							
HKLM\...\StartupApproved\Run32:	Err:510	ASUSPRP																					
HKLM\...\StartupApproved\Run32:	Err:510	WebStorage																					
HKLM\...\StartupApproved\Run32:	Err:510	BDRegion																					
HKLM\...\StartupApproved\Run32:	Err:510	BingDesktop																					
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run:	Err:510	CCleaner Monitoring																					
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run:	Err:510	Skype																					
																							
Err:510	Accounts:	Err:510																					
																							
Administrator	(S-1-5-21-3036470256-2613378711-3773960124-500	-0	Administrator	-0	Disabled)																		
Gast	(S-1-5-21-3036470256-2613378711-3773960124-501	-0	Limited	-0	Disabled)																		
Haenschen	(S-1-5-21-3036470256-2613378711-3773960124-1002	-0	Administrator	-0	Enabled)	Err:510	C:\Users\Haenschen																
HomeGroupUser$	(S-1-5-21-3036470256-2613378711-3773960124-1004	-0	Limited	-0	Enabled)																		
																							
Err:510	Faulty	Device	Manager	Devices	Err:510																		
																							
Name:																							
Description:																							
Class	Guid:																						
Manufacturer:																							
Service:																							
Problem:	:	The	drivers	for	this	device	are	not	installed.	(Code	28)												
Resolution:	To	install	the	drivers	for	this	device,	click	Update Driver,	which	starts	the	Hardware	Update	wizard.								
																							
																							
Err:510	Event	log	errors:	Err:510																			
																							
Application	errors:																						
Err:510																							
Error:	(02/06/2015	07:43:38	AM)	(Source:	Perflib)	(EventID:	1008)	(User:	)														
Description:	BITSC:\Windows\System32\bitsperf.dll8																						
																							
Error:	(02/06/2015	06:57:14	AM)	(Source:	SideBySide)	(EventID:	78)	(User:	)														
Description:	Fehler	beim	Generieren	des	Aktivierungskontexts	für	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1.	Fehler	in	Manifest-	oder	Richtliniendatei	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2	in	Zeile	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.							
Eine	für	die	Anwendung	erforderliche	Komponentenversion	steht	in	Konflikt	mit	einer	anderen,	bereits	aktiven	Komponentenversion.									
In	Konflikt	stehende	Komponenten:.																				
Komponente	1:	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.																					
Komponente	2:	C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.																					
																							
Error:	(02/06/2015	06:50:04	AM)	(Source:	Office	2013	Licensing	Service)	(EventID:	0)	(User:	)											
Description:	Subscription	licensing	service	failed:	-1073415161																		
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	Bei	der	Aktivierung	der	App	„microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“	ist	folgender	Fehler	aufgetreten:	-2144927141	Weitere	Informationen	finden	Sie	im	Protokoll	„Microsoft-Windows-TWinUI/Betriebsbereit“.					
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	Bei	der	Aktivierung	der	App	„microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“	ist	folgender	Fehler	aufgetreten:	-2144927141	Weitere	Informationen	finden	Sie	im	Protokoll	„Microsoft-Windows-TWinUI/Betriebsbereit“.					
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	Bei	der	Aktivierung	der	App	„microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“	ist	folgender	Fehler	aufgetreten:	-2144927141	Weitere	Informationen	finden	Sie	im	Protokoll	„Microsoft-Windows-TWinUI/Betriebsbereit“.					
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	Bei	der	Aktivierung	der	App	„microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“	ist	folgender	Fehler	aufgetreten:	-2144927141	Weitere	Informationen	finden	Sie	im	Protokoll	„Microsoft-Windows-TWinUI/Betriebsbereit“.					
																							
Error:	(02/05/2015	07:19:39	AM)	(Source:	SideBySide)	(EventID:	78)	(User:	)														
Description:	Fehler	beim	Generieren	des	Aktivierungskontexts	für	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1.	Fehler	in	Manifest-	oder	Richtliniendatei	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2	in	Zeile	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.							
Eine	für	die	Anwendung	erforderliche	Komponentenversion	steht	in	Konflikt	mit	einer	anderen,	bereits	aktiven	Komponentenversion.									
In	Konflikt	stehende	Komponenten:.																				
Komponente	1:	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.																					
Komponente	2:	C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.																					
																							
Error:	(02/05/2015	07:16:42	AM)	(Source:	SideBySide)	(EventID:	78)	(User:	)														
Description:	Fehler	beim	Generieren	des	Aktivierungskontexts	für	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1.	Fehler	in	Manifest-	oder	Richtliniendatei	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2	in	Zeile	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.							
Eine	für	die	Anwendung	erforderliche	Komponentenversion	steht	in	Konflikt	mit	einer	anderen,	bereits	aktiven	Komponentenversion.									
In	Konflikt	stehende	Komponenten:.																				
Komponente	1:	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.																					
Komponente	2:	C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.																					
																							
Error:	(02/05/2015	07:13:06	AM)	(Source:	Microsoft-Windows-Defrag)	(EventID:	257)	(User:	)														
Description:	Das	Volume	Windows RE tools	wurde	aufgrund	eines	Fehlers	nicht	optimiert:	Falscher	Parameter.	(0x80070057)											
																							
																							
System	errors:																						
Err:510																							
Error:	(02/06/2015	08:50:13	AM)	(Source:	EventLog)	(EventID:	6008)	(User:	)														
Description:	Das	System	wurde	zuvor	am	‎06.‎02.‎2015	um	07:43:32	unerwartet	heruntergefahren.													
																							
Error:	(02/06/2015	07:43:32	AM)	(Source:	EventLog)	(EventID:	6008)	(User:	)														
Description:	Das	System	wurde	zuvor	am	‎06.‎02.‎2015	um	07:20:03	unerwartet	heruntergefahren.													
																							
Error:	(02/06/2015	06:40:03	AM)	(Source:	EventLog)	(EventID:	6008)	(User:	)														
Description:	Das	System	wurde	zuvor	am	‎05.‎02.‎2015	um	22:45:18	unerwartet	heruntergefahren.													
																							
Error:	(02/05/2015	10:55:16	PM)	(Source:	DCOM)	(EventID:	10010)	(User:	ROGTYTAN)														
Description:	Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca																						
																							
Error:	(02/05/2015	10:55:16	PM)	(Source:	DCOM)	(EventID:	10010)	(User:	ROGTYTAN)														
Description:	Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca																						
																							
Error:	(02/05/2015	10:55:16	PM)	(Source:	DCOM)	(EventID:	10010)	(User:	ROGTYTAN)														
Description:	Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca																						
																							
Error:	(02/05/2015	10:55:16	PM)	(Source:	DCOM)	(EventID:	10010)	(User:	ROGTYTAN)														
Description:	Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca																						
																							
Error:	(02/05/2015	10:55:14	PM)	(Source:	DCOM)	(EventID:	10010)	(User:	ROGTYTAN)														
Description:	{1B1F472E-3221-4826-97DB-2C2324D389AE}																						
																							
Error:	(02/05/2015	10:55:14	PM)	(Source:	DCOM)	(EventID:	10010)	(User:	ROGTYTAN)														
Description:	{4545DEA0-2DFC-4906-A728-6D986BA399A9}																						
																							
Error:	(02/05/2015	10:55:14	PM)	(Source:	DCOM)	(EventID:	10010)	(User:	ROGTYTAN)														
Description:	{4545DEA0-2DFC-4906-A728-6D986BA399A9}																						
																							
																							
Microsoft	Office	Sessions:																					
Err:510																							
Error:	(02/06/2015	07:43:38	AM)	(Source:	Perflib)	(EventID:	1008)	(User:	)														
Description:	BITSC:\Windows\System32\bitsperf.dll8																						
																							
Error:	(02/06/2015	06:57:14	AM)	(Source:	SideBySide)	(EventID:	78)	(User:	)														
Description:	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program	Files\CCleaner\CCleaner.exe																					
																							
Error:	(02/06/2015	06:50:04	AM)	(Source:	Office	2013	Licensing	Service)	(EventID:	0)	(User:	)											
Description:	Subscription	licensing	service	failed:	-1073415161																		
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141																						
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141																						
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141																						
																							
Error:	(02/05/2015	10:55:21	PM)	(Source:	Microsoft-Windows-Immersive-Shell)	(EventID:	5973)	(User:	ROGTYTAN)														
Description:	microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141																						
																							
Error:	(02/05/2015	07:19:39	AM)	(Source:	SideBySide)	(EventID:	78)	(User:	)														
Description:	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program	Files\CCleaner\CCleaner.exe																					
																							
Error:	(02/05/2015	07:16:42	AM)	(Source:	SideBySide)	(EventID:	78)	(User:	)														
Description:	C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program	Files\CCleaner\CCleaner.exe																					
																							
Error:	(02/05/2015	07:13:06	AM)	(Source:	Microsoft-Windows-Defrag)	(EventID:	257)	(User:	)														
Description:	Windows	RE	toolsFalscher	Parameter.	(0x80070057)
         

Alt 06.02.2015, 19:42   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Aaah, was isn das?

Kann ja kein Mensch lesen.


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 07.02.2015, 07:14   #9
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2015
Ran by Haenschen at 2015-02-07 07:05:41
Running from C:\Users\Haenschen\AppData\Local\Temp\1ud6wp9o.tmp
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AbiWord 2.8.6 (HKLM-x32\...\AbiWord2) (Version: 2.8.6 - AbiSource Developers)
Active@ KillDisk 9.0 (HKLM\...\{81B939C1-0219-42B6-A352-D5E43F2BDFAE}_is1) (Version: 9.0 - LSoft Technologies Inc)
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 2.04.01 - ASUSTeK Computer Inc.)
Alcor Micro USB Card Reader Driver (HKLM-x32\...\AmUStor) (Version: 20.15.6362.54439 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver (x32 Version: 20.15.6362.54439 - Alcor Micro Corp.) Hidden
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 Beta2 - Michael Tippach)
ASUS Easy Update 2 (HKLM-x32\...\{E7AA854E-6756-424E-84C2-4E47D5729AFF}) (Version: 3.00.08 - ASUSTeK Computer Inc.)
ASUS Music Maker (HKLM-x32\...\MAGIX_{AB515018-7F9D-4047-B0C0-F26BAC30F3E1}) (Version: 18.0.4.1 - MAGIX AG)
ASUS Music Maker (Version: 18.0.4.1 - MAGIX AG) Hidden
ASUS ROG GAMING MOUSE GX900 (HKLM-x32\...\{0AD3CB15-7DAA-4A0D-AD49-2BB8485C95A3}) (Version: 1.1.0 - ASUS)
ASUSDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5424.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.5424.52 - CyberLink Corp.) Hidden
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.12.311 - ASUSTEK)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.470.0 - Microsoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco WebEx Meetings (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
Citrix Online Launcher (HKLM-x32\...\{75B8A55E-0762-4676-AAC0-6FDF025B034B}) (Version: 1.0.220 - Citrix)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
Copernic Desktop Search 4 (HKLM-x32\...\CopernicDesktopSearch4) (Version: 4.2.0.6628 - Copernic)
Copernic Desktop Search 4 (x32 Version: 4.2.0.6628 - Copernic) Hidden
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4428 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eManual (HKLM-x32\...\{0C84E634-EB68-4A54-B21E-A05EC87A4CC5}) (Version: 1.00.07 - ASUSTeK Computer Inc.)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{39AB2E37-1A55-4292-A5D3-971E9F70D0F8}) (Version: 2.1.32.0 - MAGIX AG)
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version:  - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free Audio Converter version 5.0.52.1107 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.52.1107 - DVDVideoSoft Ltd.)
Gadwin PrintScreen (64-Bit) (HKLM\...\{C4E9434D-9FA7-4D27-9805-D767A8A38904}) (Version: 5.4.0.0 - Gadwin Systems)
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Desktop (HKLM-x32\...\Google Desktop) (Version: 5.9.1005.12335 - Google)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToMeeting 6.4.11.2273 (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\GoToMeeting) (Version: 6.4.11.2273 - CitrixOnline)
Gyazo 2.3 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version:  - Nota Inc.)
hotComm® CL (HKLM-x32\...\hotComm® CL) (Version: 8.00.012x - 1stWorks Corporation)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
KaraFun Player (HKLM-x32\...\KaraFun Player_is1) (Version: 1.20.86.771 - Recisio)
Lights-Out for Windows 8 (HKLM-x32\...\Lights-Out for Windows 8) (Version: 1.5.5.2136 - AxoNet Software GmbH)
Lights-Out for Windows 8 (Version: 1.5.5.2136 - AxoNet Software GmbH) Hidden
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 326.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 326.60 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 326.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 326.60 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
OptionsOracle (HKLM-x32\...\{2C31929A-D6AB-4D0B-ABF9-4812A045CE97}) (Version: 1.600 - SamoaSky)
Paragon Backup and Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Q-Dir (HKLM-x32\...\Q-Dir) (Version:  - )
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.092613 - REALTEK Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7035 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0224 - REALTEK Semiconductor Corp.)
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
SaxoTrader 2 (HKLM-x32\...\{024D66E9-D50C-44A7-92B4-2DFDDD95D228}) (Version: 2.110.25.0 - Saxo Bank)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.104 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.26 - Piriform)
Spotify (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Strong Signal (HKLM-x32\...\Strong Signal) (Version: 2.0.5514.19469 - Strong Signal)
System Level Up Driver (HKLM-x32\...\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}) (Version: 2.02.01 - ASUSTeK Computer Inc.)
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version:  - )
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VirtualDJ 8 (HKLM-x32\...\{9ADBBA93-4625-4898-BB0D-BCE7EA9F8B4A}) (Version: 8.0.0 - Atomix Productions)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WavePad Audio-Editor (HKLM-x32\...\WavePad) (Version: 5.91 - NCH Software)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.0.3.226 - ASUS Cloud Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WSE_Binkiland (HKLM-x32\...\WSE_Binkiland) (Version:  - WSE_Binkiland)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\1468\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

21-01-2015 12:37:04 Geplanter Prüfpunkt
28-01-2015 12:15:45 Windows Update
05-02-2015 07:31:38 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2014-12-22 22:35 - 00000940 ____A C:\Windows\system32\Drivers\etc\hosts
255.255.255.255	hcurltest5
255.255.255.255	vnsjs1.1stworks.com
76.74.166.147	hcurltest2
74.208.77.54	hcurltest1


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0E24D846-57B8-4742-AC70-60A30A39EC57} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe [2013-11-05] ()
Task: {1ABAB3FB-3468-407A-ADF3-582C7403AC54} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {285483DE-28CF-4CF1-B0DC-9A88B1682826} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)
Task: {32624662-5622-446A-998C-846FE92D45D1} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-01-14] (Microsoft Corporation)
Task: {45260221-B342-4ACD-9861-0ED4057B3CED} - System32\Tasks\ASUS\ASUS AiCharger_II TrayIcon => C:\Program Files (x86)\ASUS\AI Suite II\Ai Charger II\AsChargerIITray.exe [2013-06-05] (ASUSTeK)
Task: {48C009EC-8000-4631-B0ED-527C7FCB531E} - System32\Tasks\Binkiland => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {5B3DB5D5-6D76-4F68-9C4E-EEB8B7FF4E95} - System32\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002 => C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe [2015-01-25] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {5FB32390-8214-4F69-803D-A155FC29B660} - System32\Tasks\ASUS\AsSysLevelUpSrc => C:\Program Files\ASUS\System Level Up Driver\AsSysLevelUpSrc.exe [2013-05-14] (ASUSTeK Computer Inc.)
Task: {6D947055-12CD-4CA2-B126-3A81E999D522} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-17] (Google Inc.)
Task: {6EA9E01B-7B74-4FAC-9577-237F54B717DF} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {6F37BFF2-E200-46EC-B329-3E597A0608FC} - System32\Tasks\ASUS\ASUS Easy Update 2 => C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe [2013-07-05] (ASUSTeK Computer Inc.)
Task: {BF2239D4-DA79-4C0E-946D-B22F234C232C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-17] (Google Inc.)
Task: {C6D7A547-4652-4DFF-A7FB-87187B42E6E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {CE82311C-04AA-43B7-8EC2-15FB6EFBD4E2} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)
Task: {D6C57CE6-D834-422F-BF08-938C05B2CF53} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2014-07-03] ()
Task: {DDE8225B-0639-4498-B400-D0CE272E80CC} - System32\Tasks\ASUS\ASUS AiCharger_Desktop Execute => C:\Program Files (x86)\InstallShield Installation Information\{11F6707B-88F9-4D2D-A138-27B657BAE4D2}\AiChargerDT.exe [2013-05-17] (ASUSTek Computer Inc.)
Task: {E36FA210-56F3-4BE4-A7F9-89C05AC3B399} - System32\Tasks\ASUS\ASUS Lighting Execute => C:\Program Files (x86)\ASUS\AI Suite II\Lighting\Lighting.exe [2013-04-13] (ASUSTeK)
Task: {FF168CA8-E840-4231-AFF7-FCEFF40B8CBD} - System32\Tasks\ASUS\SystemLevelUp Driver => C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe [2013-04-10] ()
Task: C:\Windows\Tasks\Binkiland.job => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job => C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-01-25 13:55 - 2013-09-26 19:15 - 00059392 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-08-05 06:33 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-12-19 11:20 - 2013-12-19 11:20 - 00075904 _____ () C:\Program Files\AxoNet Software GmbH\LightsOut\AxoNet.LightsOut.CommonTypes.W78.XmlSerializers.dll
2013-12-21 05:58 - 2012-04-24 11:43 - 00390632 ____R () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-01-25 13:53 - 2013-04-10 05:28 - 03078016 _____ () C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe
2013-12-21 05:49 - 2012-06-01 10:42 - 00920736 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
2013-12-21 05:49 - 2012-11-23 01:14 - 00050688 _____ () C:\Program Files (x86)\ASUS\ASUS Easy Update\AsMultiLang.dll
2014-01-25 13:53 - 2013-04-10 05:28 - 00179712 _____ () C:\Program Files\ASUS\System Level Up Driver\ASUSSERVICE.DLL
2014-01-25 13:53 - 2013-04-10 05:28 - 00609280 _____ () C:\Program Files\ASUS\System Level Up Driver\DeskTopToastDll.dll
2014-01-25 13:53 - 2013-04-10 05:28 - 00475136 _____ () C:\Program Files\ASUS\System Level Up Driver\HookKey32.dll
2013-12-21 05:49 - 2015-02-07 06:29 - 00029696 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll
2013-12-21 05:49 - 2010-06-29 03:58 - 00104448 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll
2014-11-04 09:48 - 2014-11-04 09:48 - 01563408 _____ () D:\Programme FestplD\Copernic.System.RT.dll
2014-08-05 06:34 - 2014-08-05 06:34 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll
2014-11-20 07:00 - 2014-11-20 07:01 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll
2014-10-25 19:36 - 2014-10-25 19:36 - 00034816 _____ () C:\Program Files (x86)\Google\Google Desktop Search\gzlib.dll
2014-01-25 13:53 - 2013-09-04 01:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2012-04-24 19:18 - 2012-04-24 19:18 - 01242472 _____ () C:\Program Files (x86)\Safari\Apple Application Support\libxml2.dll
2012-04-24 19:18 - 2012-04-24 19:18 - 00087912 _____ () C:\Program Files (x86)\Safari\Apple Application Support\zlib1.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Haenschen\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Haenschen\Downloads\Ablesung per 09.01.2014.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKLM\...\StartupApproved\Run32: => "BDRegion"
HKLM\...\StartupApproved\Run32: => "BingDesktop"
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run: => "Skype"

==================== Accounts: =============================

Administrator (S-1-5-21-3036470256-2613378711-3773960124-500 - Administrator - Disabled)
Gast (S-1-5-21-3036470256-2613378711-3773960124-501 - Limited - Disabled)
Haenschen (S-1-5-21-3036470256-2613378711-3773960124-1002 - Administrator - Enabled) => C:\Users\Haenschen
HomeGroupUser$ (S-1-5-21-3036470256-2613378711-3773960124-1004 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/07/2015 06:39:18 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (02/07/2015 06:39:18 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz
Percentage of memory in use: 15%
Total physical RAM: 16318.66 MB
Available physical RAM: 13843.4 MB
Total Pagefile: 18750.66 MB
Available Pagefile: 16139.71 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:220.94 GB) (Free:174.49 GB) NTFS
Drive d: (New Volume) (Fixed) (Total:1862.89 GB) (Free:1857.06 GB) NTFS
Drive h: (VERBATIM) (Removable) (Total:15 GB) (Free:13.52 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: E35C6A57)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================
         


Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 06.02.2015
Suchlauf-Zeit: 20:22:43
Logdatei: MalwareBytesProtokoll06022015.txt
Administrator: Nein

Version: 2.00.4.1028
Malware Datenbank: v2015.02.06.07
Rootkit Datenbank: v2015.02.03.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Haenschen

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 341944
Verstrichene Zeit: 13 Min, 40 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8.1 x64
Ran by Haenschen on 06.02.2015 at 21:48:18,45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\prefetch\DRIVERTURBO.EXE-B8190A24.pf
Successfully deleted: [File] C:\Windows\prefetch\DRIVERTURBOSETUP.EXE-28034DF4.pf
Successfully deleted: [File] C:\Users\Haenschen\AppData\Roaming\Binkiland\UpdateProc\UpdateTask.exe



~~~ Folders

Successfully deleted: [Folder] C:\Users\Haenschen\AppData\Roaming\Binkiland



~~~ FireFox

Emptied folder: C:\Users\Haenschen\AppData\Roaming\mozilla\firefox\profiles\wc32oylt.default-1404968281238\minidumps [8 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.02.2015 at 21:52:58,39
End of JRT log
         

Hi Schrauber
Das braucht Nerven bis man da alles beieinander hat!
Ich wünsche Dir eienen guten Tag

Haenschen

Code:
ATTFilter
# AdwCleaner v4.110 - Bericht erstellt 06/02/2015 um 20:43:46
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-05.2 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Haenschen - ROGTYTAN
# Gestarted von : C:\Users\Haenschen\AppData\Local\Temp\cqvd0kpu.tmp\AdwCleaner_4.110.exe
# Option : Suchlauf

***** [ Dienste ] *****

Dienst Gefunden : Service Mgr StrongSignal
Dienst Gefunden : Update Mgr StrongSignal

***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Haenschen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Startfenster.lnk
Datei Gefunden : C:\Users\Haenschen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Startfenster.lnk
Datei Gefunden : C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk
Datei Gefunden : C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\5mugt6q5.default\user.js
Datei Gefunden : C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\user.js
Datei Gefunden : C:\Users\Haenschen\Favorites\Links\Startfenster.lnk
Datei Gefunden : C:\Users\Haenschen\Favorites\Links\Startfenster.lnk
Ordner Gefunden : C:\Program Files (x86)\Common Files\ParetoLogic
Ordner Gefunden : C:\Program Files (x86)\Optimizer Pro
Ordner Gefunden : C:\ProgramData\apn
Ordner Gefunden : C:\ProgramData\ParetoLogic
Ordner Gefunden : C:\Users\Haenschen\AppData\Local\eSupport.com
Ordner Gefunden : C:\Users\Haenschen\AppData\Roaming\0S1P1R2Y1C1P1Q0D1F2W1G1I1F1T1Q
Ordner Gefunden : C:\Users\Haenschen\AppData\Roaming\DriverCure
Ordner Gefunden : C:\Users\Haenschen\AppData\Roaming\DriverTurbo
Ordner Gefunden : C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
Ordner Gefunden : C:\Users\Haenschen\AppData\Roaming\ParetoLogic
Ordner Gefunden : C:\Users\Haenschen\AppData\Roaming\RHEng
Ordner Gefunden : C:\Users\Haenschen\AppData\Roaming\WebExtend

***** [ Geplante Tasks ] *****

Task Gefunden : paretologic registration3
Task Gefunden : paretologic update version3
Task Gefunden : PC Health Advisor Defrag
Task Gefunden : PC Health Advisor

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKCU\Software\EnterDigital
Schlüssel Gefunden : HKCU\Software\eSupport.com
Schlüssel Gefunden : HKCU\Software\Google\Chrome\Extensions\ehjldlodmkdlooagebfnaghgmkfccipn
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Download &amp; Install Packages
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\Optimizer Pro
Schlüssel Gefunden : HKCU\Software\ParetoLogic
Schlüssel Gefunden : HKCU\Software\SecuredDownload
Schlüssel Gefunden : [x64] HKCU\Software\EnterDigital
Schlüssel Gefunden : [x64] HKCU\Software\eSupport.com
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A25AC313-DD19-4238-ACA2-401D6BEE4321}
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\Optimizer Pro
Schlüssel Gefunden : [x64] HKCU\Software\ParetoLogic
Schlüssel Gefunden : [x64] HKCU\Software\SecuredDownload
Schlüssel Gefunden : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gefunden : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\EnterDigital
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\ehjldlodmkdlooagebfnaghgmkfccipn
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}
Schlüssel Gefunden : HKLM\SOFTWARE\ParetoLogic
Schlüssel Gefunden : HKLM\SOFTWARE\SPPDCOM
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\ehjldlodmkdlooagebfnaghgmkfccipn
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1F74105D-11F3-4A6C-9B38-02A7A9A67B38}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67F75E1D-8F13-41F9-82BE-78AB4EAB8A32}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A25AC313-DD19-4238-ACA2-401D6BEE4321}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A25AC313-DD19-4238-ACA2-401D6BEE4321}

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v35.0.1 (x86 de)

[wc32oylt.default-1404968281238] - Zeile Gefunden : user_pref("extensions.ORJ-SPE.domain", "\"www.search.ask.com\"");
[wc32oylt.default-1404968281238] - Zeile Gefunden : user_pref("extensions.ORJ-SPE.hpr_ff", "\"hxxp://www.search.ask.com/?tpid=ORJ-SPE&o=APN11409&pf=V7&trgb=FF&p2=%5EBBH%5EOSJ000%5EYY%5ECH&gct=hp&apn_ptnrs=BBH&apn_dtid=%5EOSJ000%5EYY%5ECH&apn_dbr=ff_34.[...]
[wc32oylt.default-1404968281238] - Zeile Gefunden : user_pref("extensions.ORJ-SPE.newTabSearchURL", "\"hxxp://www.search.ask.com/web?o=APN11409&p2=%5EBBH%5EOSJ000%5EYY%5ECH&tpid=ORJ-SPE&gct=tab&apn_uid=F8732B2B-C41B-4B28-A7A2-0035CBD4BCB9&apn_ptnrs=BBH[...]
[wc32oylt.default-1404968281238] - Zeile Gefunden : user_pref("extensions.ORJ-SPE.searchURL", "\"hxxp://www.search.ask.com/web?o=APN11409&p2=%5EBBH%5EOSJ000%5EYY%5ECH&tpid=ORJ-SPE&gct=bar&apn_uid=F8732B2B-C41B-4B28-A7A2-0035CBD4BCB9&apn_ptnrs=BBH&apn_d[...]
[wc32oylt.default-1404968281238] - Zeile Gefunden : user_pref("extensions.toolbar_ORJ-SPE@apn.ask.com.install-event-fired", true);

-\\ Google Chrome v

[C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Web data] - Gefunden [Search Provider] : hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3045275
[C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Web data] - Gefunden [Search Provider] : hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_secureddownload_14_46_ff&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0B0D0DzztB0B0E0A0D0EyEtN0D0Tzu0StCtDyEyDtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyBzy0A0FtDtB0FzztGtDtAyB0FtGtCtBtDtAtGtDtD0B0FtGyC0Ezyzz0AyByC0EtB0Dzyzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0EyDtCyDyBzy0FtGzy0FtCtAtGyEtB0ByBtGzyyCtD0FtGyCtB0ByBtA0DzzyB0A0DyE0B2Q&cr=280729334&ir=

-\\ Opera v0.0.0.0

*************************

AdwCleaner[R0].txt - [1486 Bytes] - [10/07/2014 06:15:48]
AdwCleaner[R1].txt - [875 Bytes] - [10/07/2014 06:24:54]
AdwCleaner[R2].txt - [934 Bytes] - [10/07/2014 06:25:27]
AdwCleaner[R3].txt - [7053 Bytes] - [06/02/2015 20:43:46]

########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [7112 Bytes] ##########
         

Fast vergessen noch das Adware Cleaner Protokoll

Alt 07.02.2015, 12:54   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



AdwCleaner nochmal, diesmal auch auf Löschen klicken.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 07.02.2015, 18:28   #11
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Code:
ATTFilter
# AdwCleaner v4.110 - Bericht erstellt 07/02/2015 um 17:03:50
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-05.2 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Haenschen - ROGTYTAN
# Gestarted von : C:\Users\Haenschen\AppData\Local\Temp\r9vlivf2.tmp\AdwCleaner_4.110.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v35.0.1 (x86 de)


-\\ Google Chrome v


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [1486 Bytes] - [10/07/2014 06:15:48]
AdwCleaner[R1].txt - [875 Bytes] - [10/07/2014 06:24:54]
AdwCleaner[R2].txt - [934 Bytes] - [10/07/2014 06:25:27]
AdwCleaner[R3].txt - [7251 Bytes] - [06/02/2015 20:43:46]
AdwCleaner[R4].txt - [1140 Bytes] - [06/02/2015 21:24:54]
AdwCleaner[R5].txt - [1200 Bytes] - [07/02/2015 16:51:05]
AdwCleaner[R6].txt - [1259 Bytes] - [07/02/2015 17:02:21]
AdwCleaner[S0].txt - [7557 Bytes] - [06/02/2015 21:09:42]
AdwCleaner[S1].txt - [1181 Bytes] - [07/02/2015 17:03:50]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1240  Bytes] ##########
         
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=f2940b27aca2614f83234be24eacb169
# engine=22356
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-07 05:05:00
# local_time=2015-02-07 06:05:00 (+0100, Mitteleuropäische Zeit)
# country="Switzerland"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 44716 13633019 0 0
# scanned=207568
# found=22
# cleaned=0
# scan_time=2780
sh=1A3F8D5B6D34CB21B6E44A9658318D9150A9AF1C ft=1 fh=a0e05c27659340a5 vn="Variante von Win32/BrowseFox.AD evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.bak"
sh=CFBDCFE4395D68A5CABE198DAAF92E8E13991620 ft=1 fh=836931bc529fcb96 vn="Variante von Win32/BrowseFox.AD evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.exe"
sh=319605216C3733EC9FD54ECEC01259BC8CB67C2F ft=1 fh=75a60c0a389aa840 vn="Variante von Win32/BrowseFox.AD evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.bak"
sh=328CA8A09C8AF77427C59B95083DFA4BF2A077EB ft=1 fh=2a35911cb49cb0f4 vn="Variante von Win32/BrowseFox.AD evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.exe"
sh=319605216C3733EC9FD54ECEC01259BC8CB67C2F ft=1 fh=75a60c0a389aa840 vn="Variante von Win32/BrowseFox.AD evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.bak"
sh=328CA8A09C8AF77427C59B95083DFA4BF2A077EB ft=1 fh=2a35911cb49cb0f4 vn="Variante von Win32/BrowseFox.AD evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.exe"
sh=9F8A1CD5C9E5704B900AB2A9F6FD9676900B1E15 ft=1 fh=acf234848d2aac27 vn="Variante von Win32/Amonetize.DE evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000"
sh=362211208C09AFB333E36E9C41BEB097A57D6C29 ft=1 fh=6ab3ec167d6bc786 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\AbiWord - CHIP-Installer(1).exe"
sh=041C0FD34ED060FEBA166E06F181F35DAEE4573A ft=1 fh=8ffd3cd36c24d740 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\Copernic Desktop Search Lite - CHIP-Installer.exe"
sh=68DBC4E5E80BA5E688FA42822FC32F1AC6431268 ft=1 fh=e5c2229ec3dd6f13 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\dd_rescue - CHIP-Installer.exe"
sh=FF7EE9C61B0D638F5AACA1F21AC0C0D5FB55CD1A ft=1 fh=8a2b05c3361d5cf1 vn="Variante von Win32/InstallCore.UE evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\image-resizer_setup.exe"
sh=47754C4B07447801A0EB43745A6683F2D3E301A8 ft=1 fh=659f439774265590 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe"
sh=7F1E69C16B000A1F0CEE122D2D0AECA3099CB8FD ft=1 fh=39b475c38bef85a4 vn="Variante von Win32/InstallCore.RO evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\lastpass_setup.exe"
sh=DB6300A0AD7465EBDD9A5D4167A8C494024B14FB ft=1 fh=baf57cf49ef930a6 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\MCE Standby Tool - CHIP-Installer.exe"
sh=773FDF566C8228883154DD06EDDEAF890715AA92 ft=1 fh=80773cbdcdf3c0fb vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\Nitro PDF Reader 64 Bit - CHIP-Installer.exe"
sh=15A62B7CB6FF94528FAA066967E2F3324E99613E ft=1 fh=aba7dc8a7b24294d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\OpenOffice - CHIP-Installer.exe"
sh=5126CE46B371072BB60B9C521B0F01BD2A241A83 ft=1 fh=d0049656441176c3 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\Paragon Backup Recovery 2014 Free - CHIP-Installer.exe"
sh=B412AC73D455DE80F3367C5690B6477B46B5800E ft=1 fh=d46a51cd156d5beb vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\PrintScreen - CHIP-Installer.exe"
sh=BBFFD7C33F1FE7197C8C10463602E61FFC860452 ft=1 fh=405b425c5bb714c4 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\Q Dir - CHIP-Installer.exe"
sh=26D5DC7ACDF12FAD377DAC91D8C9AB7099A474F0 ft=1 fh=20ef600917025546 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\VLC media player 64 Bit - CHIP-Installer.exe"
sh=E79CE0DA43C79F2A4E48A4F4A02905DE783FBD16 ft=1 fh=a9eb553813c219ce vn="NSIS/StartPage.CC Trojaner" ac=I fn="C:\Users\Haenschen\Downloads\vlc-2.1.4-win64.exe"
sh=50775CAD1BF6B7E4FBCFD425B283E41E6338A835 ft=1 fh=23023b1f0fa9d8ab vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Haenschen\Downloads\Windows 8 Product Key Viewer - CHIP-Installer.exe"
         

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.95  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 8 Update 31  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Flash Player 	16.0.0.305  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2015
Ran by Haenschen at 2015-02-07 18:27:33
Running from C:\Users\Haenschen\AppData\Local\Temp\yid9xf2p.tmp
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AbiWord 2.8.6 (HKLM-x32\...\AbiWord2) (Version: 2.8.6 - AbiSource Developers)
Active@ KillDisk 9.0 (HKLM\...\{81B939C1-0219-42B6-A352-D5E43F2BDFAE}_is1) (Version: 9.0 - LSoft Technologies Inc)
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 2.04.01 - ASUSTeK Computer Inc.)
Alcor Micro USB Card Reader Driver (HKLM-x32\...\AmUStor) (Version: 20.15.6362.54439 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver (x32 Version: 20.15.6362.54439 - Alcor Micro Corp.) Hidden
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 Beta2 - Michael Tippach)
ASUS Easy Update 2 (HKLM-x32\...\{E7AA854E-6756-424E-84C2-4E47D5729AFF}) (Version: 3.00.08 - ASUSTeK Computer Inc.)
ASUS Music Maker (HKLM-x32\...\MAGIX_{AB515018-7F9D-4047-B0C0-F26BAC30F3E1}) (Version: 18.0.4.1 - MAGIX AG)
ASUS Music Maker (Version: 18.0.4.1 - MAGIX AG) Hidden
ASUS ROG GAMING MOUSE GX900 (HKLM-x32\...\{0AD3CB15-7DAA-4A0D-AD49-2BB8485C95A3}) (Version: 1.1.0 - ASUS)
ASUSDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5424.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.5424.52 - CyberLink Corp.) Hidden
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.12.311 - ASUSTEK)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.470.0 - Microsoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco WebEx Meetings (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
Citrix Online Launcher (HKLM-x32\...\{75B8A55E-0762-4676-AAC0-6FDF025B034B}) (Version: 1.0.220 - Citrix)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
Copernic Desktop Search 4 (HKLM-x32\...\CopernicDesktopSearch4) (Version: 4.2.0.6628 - Copernic)
Copernic Desktop Search 4 (x32 Version: 4.2.0.6628 - Copernic) Hidden
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4428 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eManual (HKLM-x32\...\{0C84E634-EB68-4A54-B21E-A05EC87A4CC5}) (Version: 1.00.07 - ASUSTeK Computer Inc.)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{39AB2E37-1A55-4292-A5D3-971E9F70D0F8}) (Version: 2.1.32.0 - MAGIX AG)
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version:  - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free Audio Converter version 5.0.52.1107 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.52.1107 - DVDVideoSoft Ltd.)
Gadwin PrintScreen (64-Bit) (HKLM\...\{C4E9434D-9FA7-4D27-9805-D767A8A38904}) (Version: 5.4.0.0 - Gadwin Systems)
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Desktop (HKLM-x32\...\Google Desktop) (Version: 5.9.1005.12335 - Google)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToMeeting 6.4.11.2273 (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\GoToMeeting) (Version: 6.4.11.2273 - CitrixOnline)
Gyazo 2.3 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version:  - Nota Inc.)
hotComm® CL (HKLM-x32\...\hotComm® CL) (Version: 8.00.012x - 1stWorks Corporation)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
KaraFun Player (HKLM-x32\...\KaraFun Player_is1) (Version: 1.20.86.771 - Recisio)
Lights-Out for Windows 8 (HKLM-x32\...\Lights-Out for Windows 8) (Version: 1.5.5.2136 - AxoNet Software GmbH)
Lights-Out for Windows 8 (Version: 1.5.5.2136 - AxoNet Software GmbH) Hidden
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 326.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 326.60 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 326.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 326.60 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
OptionsOracle (HKLM-x32\...\{2C31929A-D6AB-4D0B-ABF9-4812A045CE97}) (Version: 1.600 - SamoaSky)
Paragon Backup and Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Q-Dir (HKLM-x32\...\Q-Dir) (Version:  - )
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.092613 - REALTEK Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7035 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0224 - REALTEK Semiconductor Corp.)
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
SaxoTrader 2 (HKLM-x32\...\{024D66E9-D50C-44A7-92B4-2DFDDD95D228}) (Version: 2.110.25.0 - Saxo Bank)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.104 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.26 - Piriform)
Spotify (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Strong Signal (HKLM-x32\...\Strong Signal) (Version: 2.0.5514.19469 - Strong Signal)
System Level Up Driver (HKLM-x32\...\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}) (Version: 2.02.01 - ASUSTeK Computer Inc.)
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version:  - )
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VirtualDJ 8 (HKLM-x32\...\{9ADBBA93-4625-4898-BB0D-BCE7EA9F8B4A}) (Version: 8.0.0 - Atomix Productions)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WavePad Audio-Editor (HKLM-x32\...\WavePad) (Version: 5.91 - NCH Software)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.0.3.226 - ASUS Cloud Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WSE_Binkiland (HKLM-x32\...\WSE_Binkiland) (Version:  - WSE_Binkiland)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\1468\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

21-01-2015 12:37:04 Geplanter Prüfpunkt
28-01-2015 12:15:45 Windows Update
05-02-2015 07:31:38 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2014-12-22 22:35 - 00000940 ____A C:\Windows\system32\Drivers\etc\hosts
255.255.255.255	hcurltest5
255.255.255.255	vnsjs1.1stworks.com
76.74.166.147	hcurltest2
74.208.77.54	hcurltest1


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0E24D846-57B8-4742-AC70-60A30A39EC57} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe [2013-11-05] ()
Task: {1ABAB3FB-3468-407A-ADF3-582C7403AC54} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {285483DE-28CF-4CF1-B0DC-9A88B1682826} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)
Task: {45260221-B342-4ACD-9861-0ED4057B3CED} - System32\Tasks\ASUS\ASUS AiCharger_II TrayIcon => C:\Program Files (x86)\ASUS\AI Suite II\Ai Charger II\AsChargerIITray.exe [2013-06-05] (ASUSTeK)
Task: {48C009EC-8000-4631-B0ED-527C7FCB531E} - System32\Tasks\Binkiland => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {4A16FDF6-25B5-4AC3-8B12-95E1008370A7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-01-14] (Microsoft Corporation)
Task: {5B3DB5D5-6D76-4F68-9C4E-EEB8B7FF4E95} - System32\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002 => C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe [2015-01-25] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {5FB32390-8214-4F69-803D-A155FC29B660} - System32\Tasks\ASUS\AsSysLevelUpSrc => C:\Program Files\ASUS\System Level Up Driver\AsSysLevelUpSrc.exe [2013-05-14] (ASUSTeK Computer Inc.)
Task: {6D947055-12CD-4CA2-B126-3A81E999D522} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-17] (Google Inc.)
Task: {6EA9E01B-7B74-4FAC-9577-237F54B717DF} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {6F37BFF2-E200-46EC-B329-3E597A0608FC} - System32\Tasks\ASUS\ASUS Easy Update 2 => C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe [2013-07-05] (ASUSTeK Computer Inc.)
Task: {BF2239D4-DA79-4C0E-946D-B22F234C232C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-17] (Google Inc.)
Task: {C6D7A547-4652-4DFF-A7FB-87187B42E6E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {CE82311C-04AA-43B7-8EC2-15FB6EFBD4E2} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)
Task: {D6C57CE6-D834-422F-BF08-938C05B2CF53} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2014-07-03] ()
Task: {DDE8225B-0639-4498-B400-D0CE272E80CC} - System32\Tasks\ASUS\ASUS AiCharger_Desktop Execute => C:\Program Files (x86)\InstallShield Installation Information\{11F6707B-88F9-4D2D-A138-27B657BAE4D2}\AiChargerDT.exe [2013-05-17] (ASUSTek Computer Inc.)
Task: {E36FA210-56F3-4BE4-A7F9-89C05AC3B399} - System32\Tasks\ASUS\ASUS Lighting Execute => C:\Program Files (x86)\ASUS\AI Suite II\Lighting\Lighting.exe [2013-04-13] (ASUSTeK)
Task: {FF168CA8-E840-4231-AFF7-FCEFF40B8CBD} - System32\Tasks\ASUS\SystemLevelUp Driver => C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe [2013-04-10] ()
Task: C:\Windows\Tasks\Binkiland.job => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job => C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-01-25 13:55 - 2013-09-26 19:15 - 00059392 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-08-05 06:33 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-12-19 11:20 - 2013-12-19 11:20 - 00075904 _____ () C:\Program Files\AxoNet Software GmbH\LightsOut\AxoNet.LightsOut.CommonTypes.W78.XmlSerializers.dll
2013-12-21 05:58 - 2012-04-24 11:43 - 00390632 ____R () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-01-25 13:53 - 2013-04-10 05:28 - 03078016 _____ () C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe
2013-12-21 05:49 - 2012-06-01 10:42 - 00920736 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
2014-12-12 23:24 - 2014-12-12 23:24 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2013-12-21 05:49 - 2012-11-23 01:14 - 00050688 _____ () C:\Program Files (x86)\ASUS\ASUS Easy Update\AsMultiLang.dll
2014-01-25 13:53 - 2013-04-10 05:28 - 00179712 _____ () C:\Program Files\ASUS\System Level Up Driver\ASUSSERVICE.DLL
2014-01-25 13:53 - 2013-04-10 05:28 - 00609280 _____ () C:\Program Files\ASUS\System Level Up Driver\DeskTopToastDll.dll
2014-01-25 13:53 - 2013-04-10 05:28 - 00475136 _____ () C:\Program Files\ASUS\System Level Up Driver\HookKey32.dll
2013-12-21 05:49 - 2015-02-07 17:05 - 00029696 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll
2013-12-21 05:49 - 2010-06-29 03:58 - 00104448 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll
2014-11-04 09:48 - 2014-11-04 09:48 - 01563408 _____ () D:\Programme FestplD\Copernic.System.RT.dll
2014-08-05 06:34 - 2014-08-05 06:34 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll
2014-11-20 07:00 - 2014-11-20 07:01 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll
2014-08-13 09:27 - 2014-08-13 09:27 - 00988160 _____ () C:\Program Files (x86)\OpenOffice 4\program\libxml2.dll
2014-10-25 19:36 - 2014-10-25 19:36 - 00034816 _____ () C:\Program Files (x86)\Google\Google Desktop Search\gzlib.dll
2014-01-25 13:53 - 2013-09-04 01:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-01-28 22:33 - 2015-01-28 22:33 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-07-10 06:10 - 2014-07-10 06:10 - 01020928 _____ () C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll
2012-04-24 19:18 - 2012-04-24 19:18 - 01242472 _____ () C:\Program Files (x86)\Safari\Apple Application Support\libxml2.dll
2012-04-24 19:18 - 2012-04-24 19:18 - 00087912 _____ () C:\Program Files (x86)\Safari\Apple Application Support\zlib1.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Haenschen\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Haenschen\Downloads\Ablesung per 09.01.2014.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKLM\...\StartupApproved\Run32: => "BDRegion"
HKLM\...\StartupApproved\Run32: => "BingDesktop"
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run: => "Skype"

==================== Accounts: =============================

Administrator (S-1-5-21-3036470256-2613378711-3773960124-500 - Administrator - Disabled)
Gast (S-1-5-21-3036470256-2613378711-3773960124-501 - Limited - Disabled)
Haenschen (S-1-5-21-3036470256-2613378711-3773960124-1002 - Administrator - Enabled) => C:\Users\Haenschen
HomeGroupUser$ (S-1-5-21-3036470256-2613378711-3773960124-1004 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/07/2015 06:08:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:16:20 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:16:17 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:15:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:05:03 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (02/07/2015 07:59:04 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/07/2015 07:55:40 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/07/2015 06:39:18 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (02/07/2015 06:08:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (02/07/2015 05:16:20 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:16:17 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:15:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:05:03 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (02/07/2015 07:59:04 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program Files\CCleaner\CCleaner.exe

Error: (02/07/2015 07:55:40 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program Files\CCleaner\CCleaner.exe

Error: (02/07/2015 06:39:18 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz
Percentage of memory in use: 24%
Total physical RAM: 16318.66 MB
Available physical RAM: 12375.77 MB
Total Pagefile: 18750.66 MB
Available Pagefile: 14580.41 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:220.94 GB) (Free:174.2 GB) NTFS
Drive d: (New Volume) (Fixed) (Total:1862.89 GB) (Free:1857.06 GB) NTFS
Drive h: (VERBATIM) (Removable) (Total:15 GB) (Free:13.52 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: E35C6A57)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2015
Ran by Haenschen (administrator) on ROGTYTAN on 07-02-2015 18:26:36
Running from C:\Users\Haenschen\AppData\Local\Temp\yid9xf2p.tmp
Loaded Profiles: Haenschen (Available profiles: Haenschen)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> csrss.exe
Failed to access process -> services.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(AxoNet Software GmbH) C:\Program Files\AxoNet Software GmbH\LightsOut\LightsOutService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
Failed to access process -> MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
Failed to access process -> NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
(ASUSTeK) C:\Program Files (x86)\ASUS\AI Suite II\Lighting\Lighting.exe
(ASUSTeK) C:\Program Files (x86)\ASUS\AI Suite II\Ai Charger II\AsChargerIITray.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\InstallShield Installation Information\{11F6707B-88F9-4D2D-A138-27B657BAE4D2}\AiChargerDT.exe
() C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\System Level Up Driver\AsSysLevelUpSrc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Spotify Ltd) C:\Users\Haenschen\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Copernic, a division of N. Harris Computer Systems) D:\Programme FestplD\Copernic.DesktopSearch.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\scalc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Google) C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\scalc.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\scalc.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Apple Inc.) C:\Program Files (x86)\Safari\Safari.exe
(Apple Inc.) C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7199448 2013-09-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-26] (Realtek Semiconductor Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3216032 2013-12-21] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\ASUSWSLoader.exe [63296 2013-08-16] ()
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [181208 2013-06-24] (cyberlink)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2368736 2014-06-03] (Microsoft Corp.)
HKLM-x32\...\Run: [Google Desktop Search] => C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2014-10-25] (Google)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3095840 2014-10-27] (Nota Inc.)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Spotify Web Helper] => C:\Users\Haenschen\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-15] (Spotify Ltd)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30524000 2014-10-23] (Skype Technologies S.A.)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Copernic Desktop Search 4] => D:\Programme FestplD\Copernic.DesktopSearch.exe [1437456 2014-11-04] (Copernic, a division of N. Harris Computer Systems)
AppInit_DLLs-x32: C:\PROGRA~2\Google\GOOGLE~2\GO36F4~1.DLL => C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2014-10-25] (Google)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.ch.msn.com/
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://binkiland.com/?f=1&a=bnk_secureddownload_15_06&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0B0D0DzztB0B0E0A0D0EyEtN0D0Tzu0StCtCtAtCtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StDtByDyD0CyD0BtDtG0E0EtA0EtGzy0B0DyEtGyEtDzztAtGtB0C0AyD0BzztAyCzz0F0Dzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0EyDtCyDyBzy0FtGzy0FtCtAtGyEtB0ByBtGzyyCtD0FtGyCtB0ByBtA0DzzyB0A0DyE0B2Q&cr=1973535917&ir=
SearchScopes: HKLM -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {1F74105D-11F3-4A6C-9B38-02A7A9A67B38} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {67F75E1D-8F13-41F9-82BE-78AB4EAB8A32} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {E7455321-3BB0-42E6-B417-028DA85C66A9} URL = https://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=523482&p={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Strong Signal -> {c723a437-2eaf-466d-a95b-3fa0966bf88c} -> C:\Program Files (x86)\Strong Signal\Extensions\c723a437-2eaf-466d-a95b-3fa0966bf88c.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: Binkiland
FF Homepage: about:home
FF Keyword.URL: https://ch.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=523482&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Programme FestplD\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3036470256-2613378711-3773960124-1002: @citrixonline.com/appdetectorplugin -> C:\Users\Haenschen\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Users\Haenschen\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\qwantcom.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\wikipedia-english.xml
FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\artur.dubovoy@gmail.com [2015-02-05]
FF Extension: iCloud Bookmarks - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\firefoxdav@icloud.com [2014-11-21]
FF Extension: NetVideoHunter - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\netvideohunter@netvideohunter.com [2014-12-16]
FF Extension: LastPass - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\support@lastpass.com [2014-07-10]
FF Extension: YouTube Unblocker - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\youtubeunblocker@unblocker.yt [2015-01-25]
FF Extension: DownloadHelper - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-16]
FF Extension: Cliqz Beta - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\cliqz@cliqz.com.xpi [2014-12-03]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2014-12-16]
FF Extension: Video Downloader professional - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\ffext_basicvideoext@startpage24.xpi [2014-08-31]
FF Extension: &quot;Manage search engines&quot; button - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\jid1-XGhxOf1M8UPpsQ@jetpack.xpi [2014-11-11]
FF Extension: Youtube Downloader - Media Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\paulsaintuzb@gmail.com.xpi [2014-08-31]
FF Extension: Top Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\tvd@link64.xpi [2014-12-16]
FF Extension: Youtube and more - Easy Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\vdpure@link64.xpi [2014-08-31]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2014-08-11]
FF Extension: ALLYouTubeDownloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\YouTubetoALL@ALLPlayer.org.xpi [2014-08-31]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2014-07-18]
FF Extension: Integrated Inbox for Gmail &amp; Google Apps - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{28197867-b1ef-4140-8e3b-55c45b9c8460}.xpi [2014-08-12]
FF Extension: Strong Signal - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{629ac51d-702d-4c48-8a56-6d6a5061a41f}.xpi [2015-02-05]
FF Extension: NoScript - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-07-13]
FF Extension: Jordy Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{7CF39A35-6A8D-49B7-A730-9D742DC19693}.xpi [2014-12-16]
FF Extension: Easy Youtube Video Downloader Express - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi [2014-12-16]
FF Extension: Download YouTube Videos as MP4 - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2014-08-31]
FF Extension: Adblock Plus - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-11]
FF Extension: DownThemAll! - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-28]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-10-29]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [{b9aa91db-385d-4c69-8a2f-96790aa9405b}] - d:\programme festpld\firefoxconnector
FF Extension: Copernic Desktop Search - Search Firefox content - d:\programme festpld\firefoxconnector [2014-10-25]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR Profile: C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-17]
CHR Extension: (Google Drive) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-17]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23]
CHR Extension: (YouTube) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-17]
CHR Extension: (Video Downloader Classic) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdjbhfajlafdfaobjoklbamgkgcmohlm [2014-09-30]
CHR Extension: (Adblock Plus) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-17]
CHR Extension: (Copernic Desktop Search Connector) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnnbdaahphjgdgfhliignpepgnbnfomp [2014-10-27]
CHR Extension: (Google Search) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-17]
CHR Extension: (Logitech Smooth Scrolling) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2014-10-29]
CHR Extension: ( Youtube Video Downloader) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpdhnpgppfmlpaollphakolfdpbhdjol [2014-08-31]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-08-31]
CHR Extension: (Skype Click to Call) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-09-28]
CHR Extension: (Google Wallet) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-17]
CHR Extension: (Docs PDF/PowerPoint Viewer (by Google)) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn [2014-08-17]
CHR Extension: (Gmail) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-17]
CHR HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Chrome\Extension: [cnnbdaahphjgdgfhliignpepgnbnfomp] - d:\programme festpld\ChromeConnector\ChromeConnector.crx [2014-11-04]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

Opera: 
=======
OPR Extension: (FastestTube - YouTube Video Downloader) - C:\Users\Haenschen\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag [2014-08-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2013-09-17] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe [71680 2013-08-16] (ASUS Cloud Corporation) [File not signed]
R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [35328 2013-05-07] (Realtek Semiconductor Corporation) [File not signed]
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173792 2014-06-03] (Microsoft Corp.)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [59392 2013-09-26] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [244696 2013-06-25] (CyberLink)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-24] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2014-10-25] (Google)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 LoService; C:\Program Files\AxoNet Software GmbH\LightsOut\LightsOutService.exe [19584 2013-12-19] (AxoNet Software GmbH)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiChargerDT; C:\Windows\SysWow64\drivers\AiChargerDT.sys [14880 2012-10-18] (ASUSTek Computer Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [469264 2013-06-26] (Intel Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-07] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2944216 2013-08-21] (Realtek Semiconductor Corporation                           )
R1 UimBus; C:\Windows\System32\drivers\UimBus.sys [102664 2014-05-19] ()
R1 Uim_DEVIM; C:\Windows\System32\drivers\uim_devim.sys [25992 2014-05-19] ()
R1 Uim_IM; C:\Windows\System32\drivers\uim_im.sys [700296 2014-05-19] ()
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-07 17:15 - 2015-02-07 17:15 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-07 06:29 - 2015-02-07 17:05 - 00001160 _____ () C:\Windows\setupact.log
2015-02-07 06:29 - 2015-02-07 06:29 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-06 22:20 - 2015-02-06 22:20 - 00015360 ___SH () C:\Users\Haenschen\Desktop\Thumbs.db
2015-02-06 21:52 - 2015-02-06 21:52 - 00001110 _____ () C:\Users\Haenschen\Desktop\JRT.txt
2015-02-06 21:47 - 2015-02-07 18:24 - 00602520 _____ () C:\Windows\WindowsUpdate.log
2015-02-06 20:37 - 2015-02-06 20:37 - 00001214 _____ () C:\Users\Haenschen\Desktop\Malware BytesProtokoll.txt
2015-02-06 20:34 - 2015-02-06 20:42 - 02112512 _____ () C:\Users\Haenschen\Downloads\AdwCleaner_4.110.exe
2015-02-06 15:27 - 2015-02-06 15:27 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\OptionsOracle DataCenter
2015-02-06 15:24 - 2015-02-06 15:24 - 06286448 _____ (Microsoft Corporation) C:\Users\Haenschen\Downloads\Silverlight.exe
2015-02-06 15:24 - 2015-02-06 15:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-02-06 15:24 - 2015-02-06 15:24 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-02-06 11:13 - 2015-02-07 18:26 - 00000000 ____D () C:\FRST
2015-02-05 21:12 - 2015-02-05 21:20 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Binkiland
2015-02-05 20:59 - 2015-02-07 17:59 - 00000324 _____ () C:\Windows\Tasks\Binkiland.job
2015-02-05 20:59 - 2015-02-06 20:52 - 00000000 ____D () C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce
2015-02-05 20:59 - 2015-02-05 20:59 - 00002662 _____ () C:\Windows\System32\Tasks\Binkiland
2015-02-05 20:59 - 2015-02-05 20:59 - 00000000 ____D () C:\Program Files (x86)\Strong Signal
2015-02-05 20:58 - 2015-02-05 20:58 - 00000000 ____D () C:\Program Files (x86)\WSE_Binkiland
2015-02-03 11:11 - 2015-02-03 11:11 - 00000715 _____ () C:\Users\Haenschen\Desktop\KaraFun Player.lnk
2015-02-03 11:11 - 2015-02-03 11:11 - 00000000 ____D () C:\ProgramData\Recisio
2015-02-03 11:11 - 2015-02-03 11:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KaraFun Player
2015-02-03 11:09 - 2015-02-03 11:09 - 01191200 _____ () C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe
2015-02-03 09:35 - 2015-02-03 09:36 - 00056654 _____ () C:\Users\Haenschen\Downloads\Kontoauszug_20150203_1.zip
2015-02-02 16:10 - 2015-02-02 16:10 - 00002143 _____ () C:\Users\Haenschen\Desktop\Barchart Trader.lnk
2015-02-01 10:10 - 2015-02-01 10:10 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Image-Line
2015-01-29 15:04 - 2015-01-29 15:04 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Nitro PDF
2015-01-28 22:33 - 2015-01-28 22:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 17:50 - 2015-01-28 17:49 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-28 17:48 - 2015-01-28 17:49 - 30431144 _____ (Oracle Corporation) C:\Users\Haenschen\Downloads\jre-8u31-windows-i586.exe
2015-01-28 17:46 - 2015-01-28 17:46 - 93427112 _____ (Oracle Corporation) C:\Users\Haenschen\Downloads\jre-8u31-windows-x64.exe
2015-01-27 09:15 - 2015-01-27 09:15 - 00000796 _____ () C:\Users\Haenschen\Desktop\ASIO4ALL v2 Instruction Manual.lnk
2015-01-27 09:15 - 2015-01-27 09:15 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASIO4ALL v2
2015-01-27 09:14 - 2015-01-27 09:14 - 00000604 _____ () C:\Users\Public\Desktop\FL Studio 11 (64bit).lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000604 _____ () C:\Users\Haenschen\Desktop\FL Studio 11 (64bit).lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000592 _____ () C:\Users\Public\Desktop\FL Studio 11.lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000592 _____ () C:\Users\Haenschen\Desktop\FL Studio 11.lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files\Common Files\VST2
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files\Common Files\Propellerhead Software
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files (x86)\VstPlugins
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Users\Haenschen\Documents\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files (x86)\DSPRobotics
2015-01-27 09:05 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files (x86)\Image-Line
2015-01-18 17:56 - 2015-01-18 17:56 - 00000000 ____D () C:\Users\Haenschen\dwhelper
2015-01-16 07:01 - 2015-01-16 07:01 - 00120242 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-25.zip
2015-01-16 07:01 - 2015-01-16 07:01 - 00119874 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-38.zip
2015-01-16 07:00 - 2015-01-16 07:00 - 00120554 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-53-52.zip
2015-01-16 07:00 - 2015-01-16 07:00 - 00115565 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-9.zip
2015-01-16 06:59 - 2015-01-16 07:00 - 00115623 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-53-20.zip
2015-01-14 09:33 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 09:33 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 09:33 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-01-14 09:33 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2015-01-14 09:33 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2015-01-14 09:33 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 09:33 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 09:33 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-01-14 09:33 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2015-01-14 09:33 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2015-01-14 09:33 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-01-14 09:33 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2015-01-14 09:33 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2015-01-14 09:33 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-01-14 09:33 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-01-14 09:33 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-01-14 09:33 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-01-14 09:33 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2015-01-14 09:33 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 09:33 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-14 09:33 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-08 10:20 - 2015-01-08 10:20 - 00000000 ____D () C:\ProgramData\Gyazo

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-07 18:16 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-07 18:13 - 2014-07-10 06:15 - 00000000 ____D () C:\AdwCleaner
2015-02-07 17:58 - 2014-08-17 21:37 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-07 17:51 - 2014-08-28 15:26 - 00000604 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job
2015-02-07 17:11 - 2013-12-21 05:34 - 02742364 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-07 17:11 - 2013-09-13 21:45 - 00802234 _____ () C:\Windows\system32\perfh00C.dat
2015-02-07 17:11 - 2013-09-13 21:45 - 00159184 _____ () C:\Windows\system32\perfc00C.dat
2015-02-07 17:11 - 2013-09-13 21:22 - 00765378 _____ () C:\Windows\system32\perfh007.dat
2015-02-07 17:11 - 2013-09-13 21:22 - 00159696 _____ () C:\Windows\system32\perfc007.dat
2015-02-07 17:05 - 2014-09-30 15:58 - 00000000 ____D () C:\Users\Haenschen\OneDrive
2015-02-07 17:05 - 2014-08-17 21:37 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-07 17:05 - 2014-07-09 17:57 - 00907618 _____ () C:\Users\Haenschen\AppData\Local\BTServer.log
2015-02-07 17:04 - 2014-01-25 13:54 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-07 17:04 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-07 17:04 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-02-07 16:34 - 2014-07-09 18:29 - 00000000 ____D () C:\Jts
2015-02-07 13:02 - 2014-07-09 18:01 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C6841A14-5519-4626-9B23-774F6AF40BEB}
2015-02-07 12:31 - 2014-07-09 18:02 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3036470256-2613378711-3773960124-1002
2015-02-07 07:52 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-07 06:43 - 2014-07-10 06:05 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-07 06:29 - 2014-11-18 15:44 - 00000000 ____D () C:\ProgramData\LightsOut
2015-02-06 21:10 - 2014-07-09 17:57 - 00000000 ____D () C:\Users\Haenschen
2015-02-06 16:10 - 2014-09-01 05:48 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Adobe
2015-02-06 16:06 - 2014-12-05 19:47 - 00707072 ___SH () C:\Users\Haenschen\Downloads\Thumbs.db
2015-02-06 06:54 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-05 21:22 - 2014-08-17 21:37 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-05 20:58 - 2014-11-11 07:28 - 10934856 _____ (LastPass) C:\Users\Haenschen\Downloads\lastpass.exe
2015-02-05 17:54 - 2014-12-03 12:34 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\vlc
2015-02-04 06:53 - 2014-08-17 21:37 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-04 06:53 - 2014-08-17 21:37 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-03 22:58 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-03 20:31 - 2014-07-14 12:16 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2014-07-14 12:16 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 16:10 - 2014-08-13 18:17 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\JWrapper-Barchart
2015-02-02 16:10 - 2014-08-13 18:17 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\com.barchart.platform.release
2015-01-29 21:24 - 2014-10-19 11:00 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Spotify
2015-01-29 20:20 - 2014-10-19 11:00 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Spotify
2015-01-29 07:39 - 2014-12-24 11:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 17:50 - 2014-07-09 18:34 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-28 17:49 - 2014-12-22 18:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-28 17:48 - 2014-07-09 18:43 - 00000000 ____D () C:\Program Files\Java
2015-01-28 17:47 - 2014-12-22 18:12 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-01-25 17:48 - 2014-08-28 15:26 - 00003612 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002
2015-01-14 12:25 - 2014-07-11 17:54 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 12:20 - 2014-07-11 17:54 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-08 10:20 - 2014-09-29 06:20 - 00003762 _____ () C:\Windows\System32\Tasks\GyazoUpdateTaskMachine
2015-01-08 10:20 - 2014-09-29 06:19 - 00001005 _____ () C:\Users\Public\Desktop\Gyazo.lnk
2015-01-08 10:20 - 2014-09-29 06:19 - 00001005 _____ () C:\Users\Public\Desktop\Gyazo GIF.lnk
2015-01-08 10:20 - 2014-09-29 06:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gyazo
2015-01-08 10:20 - 2014-09-29 06:19 - 00000000 ____D () C:\Program Files (x86)\Gyazo

==================== Files in the root of some directories =======

2014-07-09 17:57 - 2015-02-07 17:05 - 0907618 _____ () C:\Users\Haenschen\AppData\Local\BTServer.log
2014-11-26 12:28 - 2014-11-26 12:28 - 0000831 _____ () C:\Users\Haenschen\AppData\Local\recently-used.xbel
2013-12-21 05:37 - 2013-12-21 05:37 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Haenschen\AppData\Local\Temp\Quarantine.exe
C:\Users\Haenschen\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 11:59

==================== End Of Log ============================
         
--- --- ---


Hi Schrauber
Die Datei von ESET bockt noch. Das heisst ich kann sie nicht löschen da etwas
in einem anderen Programm geöffnet sei. Ich weiss nur noch nicht was!
Sonst ist eigentlich alles in Butter------aber viel Stress bis alle Arbeitsschritte
durchgeführt sind.
Gruss Haenschen

Alt 08.02.2015, 11:19   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce

C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce
C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000

C:\Users\Haenschen\Downloads\AbiWord - CHIP-Installer(1).exe

C:\Users\Haenschen\Downloads\Copernic Desktop Search Lite - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\dd_rescue - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\image-resizer_setup.exe

C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\lastpass_setup.exe

C:\Users\Haenschen\Downloads\MCE Standby Tool - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Nitro PDF Reader 64 Bit - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\OpenOffice - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Paragon Backup Recovery 2014 Free - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\PrintScreen - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Q Dir - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\VLC media player 64 Bit - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\vlc-2.1.4-win64.exe

C:\Users\Haenschen\Downloads\Windows 8 Product Key Viewer - CHIP-Installer.exe
Task: {48C009EC-8000-4631-B0ED-527C7FCB531E} - System32\Tasks\Binkiland => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\Binkiland.job => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: Binkiland
FF Extension: Cliqz Beta - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\cliqz@cliqz.com.xpi [2014-12-03]
FF Extension: Copernic Desktop Search - Search Firefox content - d:\programme festpld\firefoxconnector [2014-10-25]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\extensions\cliqz@cliqz.com
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.





Frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 08.02.2015, 15:48   #13
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2015
Ran by Haenschen at 2015-02-08 15:38:14 Run:1
Running from C:\Users\Haenschen\Downloads
Loaded Profiles: Haenschen (Available profiles: Haenschen)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce

C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce
C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000

C:\Users\Haenschen\Downloads\AbiWord - CHIP-Installer(1).exe

C:\Users\Haenschen\Downloads\Copernic Desktop Search Lite - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\dd_rescue - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\image-resizer_setup.exe

C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\lastpass_setup.exe

C:\Users\Haenschen\Downloads\MCE Standby Tool - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Nitro PDF Reader 64 Bit - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\OpenOffice - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Paragon Backup Recovery 2014 Free - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\PrintScreen - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Q Dir - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\VLC media player 64 Bit - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\vlc-2.1.4-win64.exe

C:\Users\Haenschen\Downloads\Windows 8 Product Key Viewer - CHIP-Installer.exe
Task: {48C009EC-8000-4631-B0ED-527C7FCB531E} - System32\Tasks\Binkiland => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\Binkiland.job => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: Binkiland
FF Extension: Cliqz Beta - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\cliqz@cliqz.com.xpi [2014-12-03]
FF Extension: Copernic Desktop Search - Search Firefox content - d:\programme festpld\firefoxconnector [2014-10-25]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\extensions\cliqz@cliqz.com
Emptytemp:
*****************

C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce => Moved successfully.
C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce => Moved successfully.
C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000 => Moved successfully.
C:\Users\Haenschen\Downloads\AbiWord - CHIP-Installer(1).exe => Moved successfully.
C:\Users\Haenschen\Downloads\Copernic Desktop Search Lite - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\dd_rescue - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\image-resizer_setup.exe => Moved successfully.
C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\lastpass_setup.exe => Moved successfully.
C:\Users\Haenschen\Downloads\MCE Standby Tool - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Nitro PDF Reader 64 Bit - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\OpenOffice - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Paragon Backup Recovery 2014 Free - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\PrintScreen - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Q Dir - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\VLC media player 64 Bit - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\vlc-2.1.4-win64.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Windows 8 Product Key Viewer - CHIP-Installer.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{48C009EC-8000-4631-B0ED-527C7FCB531E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{48C009EC-8000-4631-B0ED-527C7FCB531E}" => Key deleted successfully.
C:\Windows\System32\Tasks\Binkiland => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Binkiland" => Key deleted successfully.
C:\Windows\Tasks\Binkiland.job => Moved successfully.
"C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1" => File/Directory not found.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\cliqz@cliqz.com.xpi => Moved successfully.
d:\programme festpld\firefoxconnector => Moved successfully.
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Mozilla\Firefox\Extensions\\cliqz@cliqz.com => value deleted successfully.
EmptyTemp: => Removed 465.3 MB temporary data.


The system needed a reboot.

==== End of Fixlog 15:38:50 ====

[CODE][Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2015
Ran by Haenschen at 2015-02-08 15:38:14 Run:1
Running from C:\Users\Haenschen\Downloads
Loaded Profiles: Haenschen (Available profiles: Haenschen)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce

C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce
C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000

C:\Users\Haenschen\Downloads\AbiWord - CHIP-Installer(1).exe

C:\Users\Haenschen\Downloads\Copernic Desktop Search Lite - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\dd_rescue - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\image-resizer_setup.exe

C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\lastpass_setup.exe

C:\Users\Haenschen\Downloads\MCE Standby Tool - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Nitro PDF Reader 64 Bit - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\OpenOffice - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Paragon Backup Recovery 2014 Free - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\PrintScreen - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\Q Dir - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\VLC media player 64 Bit - CHIP-Installer.exe

C:\Users\Haenschen\Downloads\vlc-2.1.4-win64.exe

C:\Users\Haenschen\Downloads\Windows 8 Product Key Viewer - CHIP-Installer.exe
Task: {48C009EC-8000-4631-B0ED-527C7FCB531E} - System32\Tasks\Binkiland => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\Binkiland.job => C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1
FF SearchEngineOrder.1: Websuche
FF SelectedSearchEngine: Binkiland
FF Extension: Cliqz Beta - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\cliqz@cliqz.com.xpi [2014-12-03]
FF Extension: Copernic Desktop Search - Search Firefox content - d:\programme festpld\firefoxconnector [2014-10-25]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\extensions\cliqz@cliqz.com
Emptytemp:
*****************

C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce => Moved successfully.
C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce => Moved successfully.
C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\File System\002\t\00\00000000 => Moved successfully.
C:\Users\Haenschen\Downloads\AbiWord - CHIP-Installer(1).exe => Moved successfully.
C:\Users\Haenschen\Downloads\Copernic Desktop Search Lite - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\dd_rescue - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\image-resizer_setup.exe => Moved successfully.
C:\Users\Haenschen\Downloads\KaraFun - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\lastpass_setup.exe => Moved successfully.
C:\Users\Haenschen\Downloads\MCE Standby Tool - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Nitro PDF Reader 64 Bit - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\OpenOffice - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Paragon Backup Recovery 2014 Free - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\PrintScreen - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Q Dir - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\VLC media player 64 Bit - CHIP-Installer.exe => Moved successfully.
C:\Users\Haenschen\Downloads\vlc-2.1.4-win64.exe => Moved successfully.
C:\Users\Haenschen\Downloads\Windows 8 Product Key Viewer - CHIP-Installer.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{48C009EC-8000-4631-B0ED-527C7FCB531E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{48C009EC-8000-4631-B0ED-527C7FCB531E}" => Key deleted successfully.
C:\Windows\System32\Tasks\Binkiland => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Binkiland" => Key deleted successfully.
C:\Windows\Tasks\Binkiland.job => Moved successfully.
"C:\Users\HAENSC~1\AppData\Roaming\BINKIL~1" => File/Directory not found.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\cliqz@cliqz.com.xpi => Moved successfully.
d:\programme festpld\firefoxconnector => Moved successfully.
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Mozilla\Firefox\Extensions\\cliqz@cliqz.com => value deleted successfully.
EmptyTemp: => Removed 465.3 MB temporary data.


The system needed a reboot.

==== End of Fixlog 15:38:50 ====/CODE]


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2015
Ran by Haenschen at 2015-02-08 15:41:05
Running from C:\Users\Haenschen\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AbiWord 2.8.6 (HKLM-x32\...\AbiWord2) (Version: 2.8.6 - AbiSource Developers)
Active@ KillDisk 9.0 (HKLM\...\{81B939C1-0219-42B6-A352-D5E43F2BDFAE}_is1) (Version: 9.0 - LSoft Technologies Inc)
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 2.04.01 - ASUSTeK Computer Inc.)
Alcor Micro USB Card Reader Driver (HKLM-x32\...\AmUStor) (Version: 20.15.6362.54439 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver (x32 Version: 20.15.6362.54439 - Alcor Micro Corp.) Hidden
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 Beta2 - Michael Tippach)
ASUS Easy Update 2 (HKLM-x32\...\{E7AA854E-6756-424E-84C2-4E47D5729AFF}) (Version: 3.00.08 - ASUSTeK Computer Inc.)
ASUS Music Maker (HKLM-x32\...\MAGIX_{AB515018-7F9D-4047-B0C0-F26BAC30F3E1}) (Version: 18.0.4.1 - MAGIX AG)
ASUS Music Maker (Version: 18.0.4.1 - MAGIX AG) Hidden
ASUS ROG GAMING MOUSE GX900 (HKLM-x32\...\{0AD3CB15-7DAA-4A0D-AD49-2BB8485C95A3}) (Version: 1.1.0 - ASUS)
ASUSDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5424.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.5424.52 - CyberLink Corp.) Hidden
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.12.311 - ASUSTEK)
Bing-Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.470.0 - Microsoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco WebEx Meetings (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
Citrix Online Launcher (HKLM-x32\...\{75B8A55E-0762-4676-AAC0-6FDF025B034B}) (Version: 1.0.220 - Citrix)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
Copernic Desktop Search 4 (HKLM-x32\...\CopernicDesktopSearch4) (Version: 4.2.0.6628 - Copernic)
Copernic Desktop Search 4 (x32 Version: 4.2.0.6628 - Copernic) Hidden
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4428 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eManual (HKLM-x32\...\{0C84E634-EB68-4A54-B21E-A05EC87A4CC5}) (Version: 1.00.07 - ASUSTeK Computer Inc.)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{39AB2E37-1A55-4292-A5D3-971E9F70D0F8}) (Version: 2.1.32.0 - MAGIX AG)
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version:  - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free Audio Converter version 5.0.52.1107 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.52.1107 - DVDVideoSoft Ltd.)
Gadwin PrintScreen (64-Bit) (HKLM\...\{C4E9434D-9FA7-4D27-9805-D767A8A38904}) (Version: 5.4.0.0 - Gadwin Systems)
Galeria de Fotografias (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galería de fotos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Desktop (HKLM-x32\...\Google Desktop) (Version: 5.9.1005.12335 - Google)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToMeeting 6.4.11.2273 (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\GoToMeeting) (Version: 6.4.11.2273 - CitrixOnline)
Gyazo 2.3 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version:  - Nota Inc.)
hotComm® CL (HKLM-x32\...\hotComm® CL) (Version: 8.00.012x - 1stWorks Corporation)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
KaraFun Player (HKLM-x32\...\KaraFun Player_is1) (Version: 1.20.86.771 - Recisio)
Lights-Out for Windows 8 (HKLM-x32\...\Lights-Out for Windows 8) (Version: 1.5.5.2136 - AxoNet Software GmbH)
Lights-Out for Windows 8 (Version: 1.5.5.2136 - AxoNet Software GmbH) Hidden
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)
NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 326.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 326.60 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 326.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 326.60 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
OptionsOracle (HKLM-x32\...\{2C31929A-D6AB-4D0B-ABF9-4812A045CE97}) (Version: 1.600 - SamoaSky)
Paragon Backup and Recovery™ 2014 Free (HKLM\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Q-Dir (HKLM-x32\...\Q-Dir) (Version:  - )
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.092613 - REALTEK Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7035 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0224 - REALTEK Semiconductor Corp.)
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
SaxoTrader 2 (HKLM-x32\...\{024D66E9-D50C-44A7-92B4-2DFDDD95D228}) (Version: 2.110.25.0 - Saxo Bank)
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.22 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.104 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.26 - Piriform)
Spotify (HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Strong Signal (HKLM-x32\...\Strong Signal) (Version: 2.0.5514.19469 - Strong Signal)
System Level Up Driver (HKLM-x32\...\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}) (Version: 2.02.01 - ASUSTeK Computer Inc.)
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version:  - )
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VirtualDJ 8 (HKLM-x32\...\{9ADBBA93-4625-4898-BB0D-BCE7EA9F8B4A}) (Version: 8.0.0 - Atomix Productions)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WavePad Audio-Editor (HKLM-x32\...\WavePad) (Version: 5.91 - NCH Software)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.0.3.226 - ASUS Cloud Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WSE_Binkiland (HKLM-x32\...\WSE_Binkiland) (Version:  - WSE_Binkiland)
Συλλογή φωτογραφιών (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
影像中心 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
照片库 (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\1468\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Haenschen\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

21-01-2015 12:37:04 Geplanter Prüfpunkt
28-01-2015 12:15:45 Windows Update
05-02-2015 07:31:38 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2014-12-22 22:35 - 00000940 ____A C:\Windows\system32\Drivers\etc\hosts
255.255.255.255	hcurltest5
255.255.255.255	vnsjs1.1stworks.com
76.74.166.147	hcurltest2
74.208.77.54	hcurltest1


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0E24D846-57B8-4742-AC70-60A30A39EC57} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe [2013-11-05] ()
Task: {1ABAB3FB-3468-407A-ADF3-582C7403AC54} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {285483DE-28CF-4CF1-B0DC-9A88B1682826} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)
Task: {45260221-B342-4ACD-9861-0ED4057B3CED} - System32\Tasks\ASUS\ASUS AiCharger_II TrayIcon => C:\Program Files (x86)\ASUS\AI Suite II\Ai Charger II\AsChargerIITray.exe [2013-06-05] (ASUSTeK)
Task: {5B3DB5D5-6D76-4F68-9C4E-EEB8B7FF4E95} - System32\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002 => C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe [2015-01-25] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {5FB32390-8214-4F69-803D-A155FC29B660} - System32\Tasks\ASUS\AsSysLevelUpSrc => C:\Program Files\ASUS\System Level Up Driver\AsSysLevelUpSrc.exe [2013-05-14] (ASUSTeK Computer Inc.)
Task: {6D947055-12CD-4CA2-B126-3A81E999D522} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-17] (Google Inc.)
Task: {6EA9E01B-7B74-4FAC-9577-237F54B717DF} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {6F37BFF2-E200-46EC-B329-3E597A0608FC} - System32\Tasks\ASUS\ASUS Easy Update 2 => C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe [2013-07-05] (ASUSTeK Computer Inc.)
Task: {BF2239D4-DA79-4C0E-946D-B22F234C232C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-17] (Google Inc.)
Task: {C6D7A547-4652-4DFF-A7FB-87187B42E6E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {CE82311C-04AA-43B7-8EC2-15FB6EFBD4E2} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)
Task: {D6C57CE6-D834-422F-BF08-938C05B2CF53} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2014-07-03] ()
Task: {DDE8225B-0639-4498-B400-D0CE272E80CC} - System32\Tasks\ASUS\ASUS AiCharger_Desktop Execute => C:\Program Files (x86)\InstallShield Installation Information\{11F6707B-88F9-4D2D-A138-27B657BAE4D2}\AiChargerDT.exe [2013-05-17] (ASUSTek Computer Inc.)
Task: {DF527809-C9AB-40E8-BD05-2085E0A25B35} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-01-14] (Microsoft Corporation)
Task: {E36FA210-56F3-4BE4-A7F9-89C05AC3B399} - System32\Tasks\ASUS\ASUS Lighting Execute => C:\Program Files (x86)\ASUS\AI Suite II\Lighting\Lighting.exe [2013-04-13] (ASUSTeK)
Task: {FF168CA8-E840-4231-AFF7-FCEFF40B8CBD} - System32\Tasks\ASUS\SystemLevelUp Driver => C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe [2013-04-10] ()
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job => C:\Users\Haenschen\AppData\Local\Citrix\GoToMeeting\2273\g2mupdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-01-25 13:55 - 2013-09-26 19:15 - 00059392 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-08-05 06:33 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-12-19 11:20 - 2013-12-19 11:20 - 00075904 _____ () C:\Program Files\AxoNet Software GmbH\LightsOut\AxoNet.LightsOut.CommonTypes.W78.XmlSerializers.dll
2013-12-21 05:58 - 2012-04-24 11:43 - 00390632 ____R () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-01-25 13:53 - 2013-04-10 05:28 - 03078016 _____ () C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe
2013-12-21 05:49 - 2012-06-01 10:42 - 00920736 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
2013-12-21 05:49 - 2012-11-23 01:14 - 00050688 _____ () C:\Program Files (x86)\ASUS\ASUS Easy Update\AsMultiLang.dll
2014-01-25 13:53 - 2013-04-10 05:28 - 00179712 _____ () C:\Program Files\ASUS\System Level Up Driver\ASUSSERVICE.DLL
2014-01-25 13:53 - 2013-04-10 05:28 - 00609280 _____ () C:\Program Files\ASUS\System Level Up Driver\DeskTopToastDll.dll
2014-01-25 13:53 - 2013-04-10 05:28 - 00475136 _____ () C:\Program Files\ASUS\System Level Up Driver\HookKey32.dll
2013-12-21 05:49 - 2015-02-08 15:39 - 00029696 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll
2013-12-21 05:49 - 2010-06-29 03:58 - 00104448 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll
2014-11-04 09:48 - 2014-11-04 09:48 - 01563408 _____ () D:\Programme FestplD\Copernic.System.RT.dll
2014-08-05 06:34 - 2014-08-05 06:34 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll
2014-11-20 07:00 - 2014-11-20 07:01 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Haenschen\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Haenschen\Downloads\Ablesung per 09.01.2014.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "ASUSPRP"
HKLM\...\StartupApproved\Run32: => "WebStorage"
HKLM\...\StartupApproved\Run32: => "BDRegion"
HKLM\...\StartupApproved\Run32: => "BingDesktop"
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\StartupApproved\Run: => "Skype"

==================== Accounts: =============================

Administrator (S-1-5-21-3036470256-2613378711-3773960124-500 - Administrator - Disabled)
Gast (S-1-5-21-3036470256-2613378711-3773960124-501 - Limited - Disabled)
Haenschen (S-1-5-21-3036470256-2613378711-3773960124-1002 - Administrator - Enabled) => C:\Users\Haenschen
HomeGroupUser$ (S-1-5-21-3036470256-2613378711-3773960124-1004 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/08/2015 03:38:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x1e14
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5

Error: (02/08/2015 09:16:54 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/08/2015 07:38:55 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (02/07/2015 06:08:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:16:20 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:16:17 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:15:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (02/07/2015 05:05:03 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (02/08/2015 03:38:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f22480000003000014251e1401d043a80b2b0699C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll1c808dab-afa0-11e4-83fc-54271e6bd728

Error: (02/08/2015 09:16:54 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Program Files\CCleaner\CCleaner.exe

Error: (02/08/2015 07:38:55 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (02/07/2015 06:08:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (02/07/2015 05:16:20 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:16:17 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:15:52 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:15:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\HAENSC~1\AppData\Local\Temp\vwsrumst.tmp\esetsmartinstaller_deu.exe

Error: (02/07/2015 05:05:03 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz
Percentage of memory in use: 11%
Total physical RAM: 16318.66 MB
Available physical RAM: 14436.02 MB
Total Pagefile: 18750.66 MB
Available Pagefile: 16782.38 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:220.94 GB) (Free:173.76 GB) NTFS
Drive d: (New Volume) (Fixed) (Total:1862.89 GB) (Free:1857.06 GB) NTFS
Drive h: (VERBATIM) (Removable) (Total:15 GB) (Free:13.52 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 238.5 GB) (Disk ID: E35C6A57)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================
         

Alt 08.02.2015, 18:19   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz



eine frische FRST.txt bitte
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 08.02.2015, 20:17   #15
Haenschen
 
Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Standard

Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz




FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2015
Ran by Haenschen (administrator) on ROGTYTAN on 08-02-2015 20:19:17
Running from C:\Users\Haenschen\Downloads
Loaded Profiles: Haenschen (Available profiles: Haenschen)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> csrss.exe
Failed to access process -> services.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(AxoNet Software GmbH) C:\Program Files\AxoNet Software GmbH\LightsOut\LightsOutService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
Failed to access process -> MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
Failed to access process -> NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\InstallShield Installation Information\{11F6707B-88F9-4D2D-A138-27B657BAE4D2}\AiChargerDT.exe
(ASUSTeK) C:\Program Files (x86)\ASUS\AI Suite II\Ai Charger II\AsChargerIITray.exe
() C:\Program Files\ASUS\System Level Up Driver\SysLevelUp.exe
(ASUSTeK) C:\Program Files (x86)\ASUS\AI Suite II\Lighting\Lighting.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\System Level Up Driver\AsSysLevelUpSrc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Spotify Ltd) C:\Users\Haenschen\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Copernic, a division of N. Harris Computer Systems) D:\Programme FestplD\Copernic.DesktopSearch.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Google) C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Farbar) C:\Users\Haenschen\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7199448 2013-09-05] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-26] (Realtek Semiconductor Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3216032 2013-12-21] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\ASUSWSLoader.exe [63296 2013-08-16] ()
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-09] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [181208 2013-06-24] (cyberlink)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2368736 2014-06-03] (Microsoft Corp.)
HKLM-x32\...\Run: [Google Desktop Search] => C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2014-10-25] (Google)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3095840 2014-10-27] (Nota Inc.)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Spotify Web Helper] => C:\Users\Haenschen\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-15] (Spotify Ltd)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30524000 2014-10-23] (Skype Technologies S.A.)
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Run: [Copernic Desktop Search 4] => D:\Programme FestplD\Copernic.DesktopSearch.exe [1437456 2014-11-04] (Copernic, a division of N. Harris Computer Systems)
AppInit_DLLs-x32: C:\PROGRA~2\Google\GOOGLE~2\GO36F4~1.DLL => C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2014-10-25] (Google)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.0.3.226\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.ch.msn.com/
HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://binkiland.com/?f=1&a=bnk_secureddownload_15_06&cd=2XzuyEtN2Y1L1Qzu0B0C0E0EyB0B0D0DzztB0B0E0A0D0EyEtN0D0Tzu0StCtCtAtCtN1L2XzutAtFyBtFyBtFyDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StDtByDyD0CyD0BtDtG0E0EtA0EtGzy0B0DyEtGyEtDzztAtGtB0C0AyD0BzztAyCzz0F0Dzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0EyDtCyDyBzy0FtGzy0FtCtAtGyEtB0ByBtGzyyCtD0FtGyCtB0ByBtA0DzzyB0A0DyE0B2Q&cr=1973535917&ir=
SearchScopes: HKLM -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {1F74105D-11F3-4A6C-9B38-02A7A9A67B38} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {67F75E1D-8F13-41F9-82BE-78AB4EAB8A32} URL = 
SearchScopes: HKU\S-1-5-21-3036470256-2613378711-3773960124-1002 -> {E7455321-3BB0-42E6-B417-028DA85C66A9} URL = https://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=523482&p={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: Strong Signal -> {c723a437-2eaf-466d-a95b-3fa0966bf88c} -> C:\Program Files (x86)\Strong Signal\Extensions\c723a437-2eaf-466d-a95b-3fa0966bf88c.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238
FF DefaultSearchEngine: Qwant.com
FF Homepage: about:home
FF Keyword.URL: https://ch.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=523482&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Programme FestplD\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3036470256-2613378711-3773960124-1002: @citrixonline.com/appdetectorplugin -> C:\Users\Haenschen\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Users\Haenschen\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\qwantcom.xml
FF SearchPlugin: C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\searchplugins\wikipedia-english.xml
FF Extension: Flash Video Downloader - YouTube HD Download [4K] - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\artur.dubovoy@gmail.com [2015-02-08]
FF Extension: iCloud Bookmarks - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\firefoxdav@icloud.com [2014-11-21]
FF Extension: NetVideoHunter - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\netvideohunter@netvideohunter.com [2014-12-16]
FF Extension: LastPass - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\support@lastpass.com [2014-07-10]
FF Extension: YouTube Unblocker - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\youtubeunblocker@unblocker.yt [2015-01-25]
FF Extension: DownloadHelper - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-12-16]
FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\DailymotionVideoDownloader@PeterOlayev.com.xpi [2014-12-16]
FF Extension: Video Downloader professional - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\ffext_basicvideoext@startpage24.xpi [2014-08-31]
FF Extension: &quot;Manage search engines&quot; button - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\jid1-XGhxOf1M8UPpsQ@jetpack.xpi [2014-11-11]
FF Extension: Youtube Downloader - Media Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\paulsaintuzb@gmail.com.xpi [2014-08-31]
FF Extension: Top Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\tvd@link64.xpi [2014-12-16]
FF Extension: Youtube and more - Easy Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\vdpure@link64.xpi [2014-08-31]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2014-08-11]
FF Extension: ALLYouTubeDownloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\YouTubetoALL@ALLPlayer.org.xpi [2014-08-31]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2014-07-18]
FF Extension: Integrated Inbox for Gmail &amp; Google Apps - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{28197867-b1ef-4140-8e3b-55c45b9c8460}.xpi [2014-08-12]
FF Extension: Strong Signal - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{629ac51d-702d-4c48-8a56-6d6a5061a41f}.xpi [2015-02-05]
FF Extension: NoScript - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-07-13]
FF Extension: Jordy Video Downloader - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{7CF39A35-6A8D-49B7-A730-9D742DC19693}.xpi [2014-12-16]
FF Extension: Easy Youtube Video Downloader Express - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9acf540-acba-11e1-8ccb-001fd0e08bd4}.xpi [2014-12-16]
FF Extension: Download YouTube Videos as MP4 - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2014-08-31]
FF Extension: Adblock Plus - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-11]
FF Extension: DownThemAll! - C:\Users\Haenschen\AppData\Roaming\Mozilla\Firefox\Profiles\wc32oylt.default-1404968281238\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-28]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-10-29]
FF HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Firefox\Extensions: [{b9aa91db-385d-4c69-8a2f-96790aa9405b}] - d:\programme festpld\firefoxconnector

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovi.com/?gd=&ctid=CT3331398&octid=EB_ORIGINAL_CTID&ISID=MFFA2E478-E846-4C37-9533-0B40EAC491C6&SearchSource=55&CUI=&UM=6&UP=SPEF27EB91-3230-4258-BA6D-B7588FC7C22E&SSPV=
CHR DefaultSearchKeyword: Default -> 127.0.0.1
CHR DefaultSearchURL: Default -> hxxp://127.0.0.1:4664/search&s=KAa-QvjjmpqR8gMTMYd8YJMIW-4?q={searchTerms}
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-07]
CHR Extension: (Google Docs) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-17]
CHR Extension: (Google Drive) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-17]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-08]
CHR Extension: (YouTube) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-17]
CHR Extension: (Adblock Plus) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-02-07]
CHR Extension: (Copernic Desktop Search Connector) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnnbdaahphjgdgfhliignpepgnbnfomp [2014-10-27]
CHR Extension: (Google Search) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-17]
CHR Extension: (Logitech Smooth Scrolling) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2015-02-07]
CHR Extension: (Google Sheets) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-07]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2015-02-07]
CHR Extension: (Skype Click to Call) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-09-28]
CHR Extension: (Google Wallet) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-17]
CHR Extension: (Docs PDF/PowerPoint Viewer (by Google)) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn [2015-02-07]
CHR Extension: (Gmail) - C:\Users\Haenschen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-17]
CHR HKU\S-1-5-21-3036470256-2613378711-3773960124-1002\...\Chrome\Extension: [cnnbdaahphjgdgfhliignpepgnbnfomp] - d:\programme festpld\ChromeConnector\ChromeConnector.crx [2014-11-04]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

Opera: 
=======
OPR Extension: (FastestTube - YouTube Video Downloader) - C:\Users\Haenschen\AppData\Roaming\Opera Software\Opera Stable\Extensions\phahnhbgfdhgobenebnjbgmacgpbfaag [2014-08-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2013-09-17] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.0.3.226\AsusWSWinService.exe [71680 2013-08-16] (ASUS Cloud Corporation) [File not signed]
R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [35328 2013-05-07] (Realtek Semiconductor Corporation) [File not signed]
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173792 2014-06-03] (Microsoft Corp.)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [59392 2013-09-26] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [244696 2013-06-25] (CyberLink)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-24] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2014-10-25] (Google)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 LoService; C:\Program Files\AxoNet Software GmbH\LightsOut\LightsOutService.exe [19584 2013-12-19] (AxoNet Software GmbH)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiChargerDT; C:\Windows\SysWow64\drivers\AiChargerDT.sys [14880 2012-10-18] (ASUSTek Computer Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [469264 2013-06-26] (Intel Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-07] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2944216 2013-08-21] (Realtek Semiconductor Corporation                           )
R1 UimBus; C:\Windows\System32\drivers\UimBus.sys [102664 2014-05-19] ()
R1 Uim_DEVIM; C:\Windows\System32\drivers\uim_devim.sys [25992 2014-05-19] ()
R1 Uim_IM; C:\Windows\System32\drivers\uim_im.sys [700296 2014-05-19] ()
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-08 15:41 - 2015-02-08 15:41 - 00037184 _____ () C:\Users\Haenschen\Downloads\Addition.txt
2015-02-08 15:40 - 2015-02-08 20:19 - 00031924 _____ () C:\Users\Haenschen\Downloads\FRST.txt
2015-02-08 15:34 - 2015-02-08 15:34 - 02132992 _____ (Farbar) C:\Users\Haenschen\Downloads\FRST64 (2).exe
2015-02-08 15:34 - 2015-02-08 15:34 - 02132992 _____ (Farbar) C:\Users\Haenschen\Downloads\FRST64 (1).exe
2015-02-08 15:32 - 2015-02-08 15:32 - 02132992 _____ (Farbar) C:\Users\Haenschen\Downloads\FRST64.exe
2015-02-08 07:49 - 2015-02-08 07:49 - 14291000 _____ () C:\Users\Haenschen\Downloads\lastpass_x64.exe
2015-02-08 07:28 - 2015-02-08 15:39 - 00000978 _____ () C:\Windows\PFRO.log
2015-02-07 21:16 - 2015-02-07 21:16 - 00002278 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-07 21:16 - 2015-02-07 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-02-07 06:29 - 2015-02-08 20:13 - 00004060 _____ () C:\Windows\setupact.log
2015-02-07 06:29 - 2015-02-07 06:29 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-06 22:20 - 2015-02-06 22:20 - 00015360 ___SH () C:\Users\Haenschen\Desktop\Thumbs.db
2015-02-06 21:52 - 2015-02-06 21:52 - 00001110 _____ () C:\Users\Haenschen\Desktop\JRT.txt
2015-02-06 21:47 - 2015-02-08 12:13 - 00791504 _____ () C:\Windows\WindowsUpdate.log
2015-02-06 20:37 - 2015-02-06 20:37 - 00001214 _____ () C:\Users\Haenschen\Desktop\Malware BytesProtokoll.txt
2015-02-06 20:34 - 2015-02-06 20:42 - 02112512 _____ () C:\Users\Haenschen\Downloads\AdwCleaner_4.110.exe
2015-02-06 15:27 - 2015-02-06 15:27 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\OptionsOracle DataCenter
2015-02-06 15:24 - 2015-02-06 15:24 - 06286448 _____ (Microsoft Corporation) C:\Users\Haenschen\Downloads\Silverlight.exe
2015-02-06 15:24 - 2015-02-06 15:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-02-06 15:24 - 2015-02-06 15:24 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-02-06 11:13 - 2015-02-08 20:19 - 00000000 ____D () C:\FRST
2015-02-05 21:12 - 2015-02-05 21:20 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Binkiland
2015-02-05 20:59 - 2015-02-05 20:59 - 00000000 ____D () C:\Program Files (x86)\Strong Signal
2015-02-05 20:58 - 2015-02-05 20:58 - 00000000 ____D () C:\Program Files (x86)\WSE_Binkiland
2015-02-03 11:11 - 2015-02-03 11:11 - 00000715 _____ () C:\Users\Haenschen\Desktop\KaraFun Player.lnk
2015-02-03 11:11 - 2015-02-03 11:11 - 00000000 ____D () C:\ProgramData\Recisio
2015-02-03 11:11 - 2015-02-03 11:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KaraFun Player
2015-02-03 09:35 - 2015-02-03 09:36 - 00056654 _____ () C:\Users\Haenschen\Downloads\Kontoauszug_20150203_1.zip
2015-02-02 16:10 - 2015-02-02 16:10 - 00002143 _____ () C:\Users\Haenschen\Desktop\Barchart Trader.lnk
2015-02-01 10:10 - 2015-02-01 10:10 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Image-Line
2015-01-29 15:04 - 2015-01-29 15:04 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Nitro PDF
2015-01-28 22:33 - 2015-01-28 22:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 17:50 - 2015-01-28 17:49 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-28 17:48 - 2015-01-28 17:49 - 30431144 _____ (Oracle Corporation) C:\Users\Haenschen\Downloads\jre-8u31-windows-i586.exe
2015-01-28 17:46 - 2015-01-28 17:46 - 93427112 _____ (Oracle Corporation) C:\Users\Haenschen\Downloads\jre-8u31-windows-x64.exe
2015-01-27 09:15 - 2015-01-27 09:15 - 00000796 _____ () C:\Users\Haenschen\Desktop\ASIO4ALL v2 Instruction Manual.lnk
2015-01-27 09:15 - 2015-01-27 09:15 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASIO4ALL v2
2015-01-27 09:14 - 2015-01-27 09:14 - 00000604 _____ () C:\Users\Public\Desktop\FL Studio 11 (64bit).lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000604 _____ () C:\Users\Haenschen\Desktop\FL Studio 11 (64bit).lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000592 _____ () C:\Users\Public\Desktop\FL Studio 11.lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000592 _____ () C:\Users\Haenschen\Desktop\FL Studio 11.lnk
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files\Common Files\VST2
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files\Common Files\Propellerhead Software
2015-01-27 09:14 - 2015-01-27 09:14 - 00000000 ____D () C:\Program Files (x86)\VstPlugins
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Users\Haenschen\Documents\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files\Image-Line
2015-01-27 09:13 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files (x86)\DSPRobotics
2015-01-27 09:05 - 2015-01-27 09:13 - 00000000 ____D () C:\Program Files (x86)\Image-Line
2015-01-18 17:56 - 2015-01-18 17:56 - 00000000 ____D () C:\Users\Haenschen\dwhelper
2015-01-16 07:01 - 2015-01-16 07:01 - 00120242 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-25.zip
2015-01-16 07:01 - 2015-01-16 07:01 - 00119874 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-38.zip
2015-01-16 07:00 - 2015-01-16 07:00 - 00120554 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-53-52.zip
2015-01-16 07:00 - 2015-01-16 07:00 - 00115565 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-54-9.zip
2015-01-16 06:59 - 2015-01-16 07:00 - 00115623 _____ () C:\Users\Haenschen\Downloads\e-documents 2015-1-16-6-53-20.zip
2015-01-14 09:33 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 09:33 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 09:33 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-01-14 09:33 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-01-14 09:33 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2015-01-14 09:33 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2015-01-14 09:33 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 09:33 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 09:33 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-01-14 09:33 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2015-01-14 09:33 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2015-01-14 09:33 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-01-14 09:33 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-01-14 09:33 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2015-01-14 09:33 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2015-01-14 09:33 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-01-14 09:33 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-01-14 09:33 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-01-14 09:33 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-01-14 09:33 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2015-01-14 09:33 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 09:33 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-01-14 09:33 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-08 20:19 - 2013-12-21 05:34 - 02742364 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-08 20:19 - 2013-09-13 21:45 - 00802234 _____ () C:\Windows\system32\perfh00C.dat
2015-02-08 20:19 - 2013-09-13 21:45 - 00159184 _____ () C:\Windows\system32\perfc00C.dat
2015-02-08 20:19 - 2013-09-13 21:22 - 00765378 _____ () C:\Windows\system32\perfh007.dat
2015-02-08 20:19 - 2013-09-13 21:22 - 00159696 _____ () C:\Windows\system32\perfc007.dat
2015-02-08 20:13 - 2014-09-30 15:58 - 00000000 ___RD () C:\Users\Haenschen\OneDrive
2015-02-08 20:13 - 2014-08-17 21:37 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-08 20:13 - 2014-07-09 17:57 - 00916649 _____ () C:\Users\Haenschen\AppData\Local\BTServer.log
2015-02-08 20:13 - 2014-01-25 13:54 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-08 20:13 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-08 17:13 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-02-08 17:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-08 16:58 - 2014-08-17 21:37 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-08 16:51 - 2014-08-28 15:26 - 00000604 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002.job
2015-02-08 15:05 - 2014-07-09 18:01 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C6841A14-5519-4626-9B23-774F6AF40BEB}
2015-02-08 09:13 - 2014-07-09 18:02 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3036470256-2613378711-3773960124-1002
2015-02-08 07:28 - 2014-11-18 15:44 - 00000000 ____D () C:\ProgramData\LightsOut
2015-02-07 21:16 - 2014-08-17 21:37 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-07 18:13 - 2014-07-10 06:15 - 00000000 ____D () C:\AdwCleaner
2015-02-07 16:34 - 2014-07-09 18:29 - 00000000 ____D () C:\Jts
2015-02-07 07:52 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-07 06:43 - 2014-07-10 06:05 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-06 21:10 - 2014-07-09 17:57 - 00000000 ____D () C:\Users\Haenschen
2015-02-06 16:10 - 2014-09-01 05:48 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Adobe
2015-02-06 16:06 - 2014-12-05 19:47 - 00707072 ___SH () C:\Users\Haenschen\Downloads\Thumbs.db
2015-02-06 06:54 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-05 20:58 - 2014-11-11 07:28 - 10934856 _____ (LastPass) C:\Users\Haenschen\Downloads\lastpass.exe
2015-02-05 17:54 - 2014-12-03 12:34 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\vlc
2015-02-04 06:53 - 2014-08-17 21:37 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-04 06:53 - 2014-08-17 21:37 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-03 22:58 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-03 20:31 - 2014-07-14 12:16 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2014-07-14 12:16 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 16:10 - 2014-08-13 18:17 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\JWrapper-Barchart
2015-02-02 16:10 - 2014-08-13 18:17 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\com.barchart.platform.release
2015-01-29 21:24 - 2014-10-19 11:00 - 00000000 ____D () C:\Users\Haenschen\AppData\Roaming\Spotify
2015-01-29 20:20 - 2014-10-19 11:00 - 00000000 ____D () C:\Users\Haenschen\AppData\Local\Spotify
2015-01-29 07:39 - 2014-12-24 11:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 17:50 - 2014-07-09 18:34 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-28 17:49 - 2014-12-22 18:11 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-28 17:48 - 2014-07-09 18:43 - 00000000 ____D () C:\Program Files\Java
2015-01-28 17:47 - 2014-12-22 18:12 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-01-25 17:48 - 2014-08-28 15:26 - 00003612 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3036470256-2613378711-3773960124-1002
2015-01-14 12:25 - 2014-07-11 17:54 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 12:20 - 2014-07-11 17:54 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2014-07-09 17:57 - 2015-02-08 20:13 - 0916649 _____ () C:\Users\Haenschen\AppData\Local\BTServer.log
2014-11-26 12:28 - 2014-11-26 12:28 - 0000831 _____ () C:\Users\Haenschen\AppData\Local\recently-used.xbel
2013-12-21 05:37 - 2013-12-21 05:37 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-31 11:59

==================== End Of Log ============================
         
--- --- ---

Antwort

Themen zu Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz
bikiniland, bildschirm, blieb, bluescreen, bytes, desktop, dilemma, einfach, firefox, forum, funktioniert, guten, klicke, langsam, länger, malware, malware bytes, mauszeiger, monitor, monitor schwarz, neustart, quarantäne, schwarz, software, suchmaschine, taskmanager, update, windows



Ähnliche Themen: Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz


  1. Bikiniland eingefangen
    Log-Analyse und Auswertung - 26.02.2015 (21)
  2. Windows 8.1 Binkilandproblem und Monitor schwarz
    Plagegeister aller Art und deren Bekämpfung - 17.02.2015 (21)
  3. Bikiniland Trojaner erfolgreich entfernt?
    Log-Analyse und Auswertung - 12.02.2015 (9)
  4. wenn ich meinen Rechner hochfahre (Windows 8.1) komme ich bis zur Passwort-Abfrage. Der Monitor meines Pavilion Netbooks wird schwarz.
    Log-Analyse und Auswertung - 08.02.2015 (9)
  5. Bekomme Bikiniland nicht weg
    Log-Analyse und Auswertung - 06.02.2015 (5)
  6. Registry Monitor Fenster Labtec Webcam 1200-monitor.exe Virus?
    Plagegeister aller Art und deren Bekämpfung - 17.01.2014 (7)
  7. Monitor bleibt nach Booten und WinLogo schwarz, nur Mauszeiger da.
    Alles rund um Windows - 22.11.2013 (15)
  8. Monitor Schwarz, Mauszeiger sichtbar, Windows 7 32bit
    Log-Analyse und Auswertung - 05.10.2013 (3)
  9. BKA Trojaner - Monitor schwarz
    Plagegeister aller Art und deren Bekämpfung - 05.12.2012 (16)
  10. Monitor wird Schwarz mit roter Schrift ( Windows blockiert bezahlen um es wieder zu aktivieren)
    Log-Analyse und Auswertung - 25.04.2012 (1)
  11. Monitor wird Schwarz mit roter Schrift ( Windows blockiert 100 € um es wieder zu aktivieren)
    Plagegeister aller Art und deren Bekämpfung - 24.04.2012 (13)
  12. Bekämpfung von Windows Vista Repair Trojaner und TDSS Killer startet nicht
    Plagegeister aller Art und deren Bekämpfung - 28.06.2011 (23)
  13. Windows Recovery Trojaner - erste Bekämpfung und Frage zu externer Festplatte
    Log-Analyse und Auswertung - 30.04.2011 (12)
  14. Laptop-Monitor wird plötzlich schwarz
    Plagegeister aller Art und deren Bekämpfung - 05.10.2010 (0)
  15. Logfiles vorher/nachher, System wieder benutzbar??
    Log-Analyse und Auswertung - 19.03.2009 (0)
  16. Monitor wird schwarz und Rechner hängt sich auf
    Mülltonne - 11.09.2008 (0)
  17. Vorher vs. nachher. Auffälligkeiten?
    Log-Analyse und Auswertung - 09.05.2006 (10)

Zum Thema Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz - Einen guten Tag dem Forum, Ich hatte mir gestern eine sehr agressive Suchmaschinenplage mit dem Namen BIKINILAND im Firefox eingefangen. Dieses Bikiniland erschien auch sofort im Chrome Browser. Ich habe - Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz...
Archiv
Du betrachtest: Windows 8.1 Bekämpfung Bikiniland Suchm. nachher Monitor schwarz auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.