Windows 8.1 Malware B findet viele Enträge, Rechner langsam, Maus wechselt ständig in Sanduhr

PCOldie · 01.03.2015, 00:15

Hallo Trojaner-Board,

sitze gerade beim Kollegen am Rechner, der sich über sein Laptop beschwert hat, das das so langsam geworden ist.
Jetzt habe ich mal den Malware Byte drüber laufen lassen und erschreckend festgestellt, das hier hunderte Einträge gefunden wurden.
Außerdem wechselt der Mauszeiger ständig und zeigt an das er irgendetwas ausführt.

Im Anschluss habe ich den Defogger, FRST64 und GMER gestartet.

GMER stürzt leider immer ab. Also gibt es hierzu kein Log.
Ich hoffe ihr könnt uns helfen.

Da der MB Code so lang ist füge ich ihn als ZIP bei.

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:29 on 28/02/2015 (Thomas)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-02-2015 01
Ran by Thomas (administrator) on THOMAS on 28-02-2015 23:31:34
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available profiles: Thomas)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Users\Thomas\AppData\Local\RGMService\RGMUpdater.exe
() C:\Users\Thomas\AppData\Local\RGMService\RGMLoader.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
() C:\Program Files\Synaptics\SynTP\DellTouchpad.exe
(Smartbar) C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.exe
() C:\Users\Thomas\AppData\Local\LPT\srptm.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssist\uaclauncher.exe
(The Chromium Authors) C:\Users\Thomas\AppData\Local\Chrome\Application\chrome.exe
(The Chromium Authors) C:\Users\Thomas\AppData\Local\Chrome\Application\chrome.exe
(The Chromium Authors) C:\Users\Thomas\AppData\Local\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
() C:\Users\Thomas\AppData\Local\Smartbar\Application\Lrcnta.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6842000 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1230992 2012-09-28] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [5757328 2012-10-19] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2918200 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [DellWPF] => C:\Program Files\Synaptics\SynTP\DellTouchpad.exe [4875576 2012-09-21] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-07-09] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-10-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [143888 2012-06-01] (CyberLink Corp.)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-10-25] (Check Point Software Technologies LTD)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\Run: [Browser Infrastructure Helper] => C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.exe [29696 2014-09-30] (Smartbar)
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\Run: [LPT System Updater] => C:\Users\Thomas\AppData\Local\LPT\srptm.exe [23832 2014-06-11] ()
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe  --flag-switches-begin --flag-switches-end --restore-last-session https://www.facebook.com/n/?pages/&category=invites&ref=page_fan_invite_em (the data entry has 159 more characters).
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\MountPoints2: {a8542726-43bc-11e4-be97-6036ddc18148} - "E:\Startme.exe" 
AppInit_DLLs: C:\Users\Thomas\AppData\Local\Smartbar\Application\Resources\crdlil64.dll => C:\Users\Thomas\AppData\Local\Smartbar\Application\Resources\crdlil64.dll [138752 2015-02-08] ()
AppInit_DLLs-x32: C:\Users\Thomas\AppData\Local\Smartbar\Application\Resources\crdlil.dll => C:\Users\Thomas\AppData\Local\Smartbar\Application\Resources\crdlil.dll [120320 2015-02-08] ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb9UAVlpOoZG0nZc1hBPudVcZ_HOXVUaLWjyuTmFc_7tLSKeYcsPYPNYgm280VK60RlgY0LuIochKiPInv0tCQqMqqkOHIaeYuHgvm9IL-8GFJZU-wr2vzKhLqiCK3bYOHyuB29CcP7tq0wrxHchYNPFDt_cTwgFp9p9Q,,&q={searchTerms}
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb9UAVlpOoZG0nZc1hBPudVcZ_HOXVUaLWjyuTmFc_7tLSKeYcsPYPNYgm280VK60RpA605GPmg050fTRzQref3kJPUYlMDCHAxKAvVN3ojsIBWBjrkOLf5e0YROO54tMszvwYPOIftXnnllFtUQIFSV5Y4kgHDoi2COQ,,
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb9UAVlpOoZG0nZc1hBPudVcZ_HOXVUaLWjyuTmFc_7tLSKeYcsPYPNYgm280VK60RlgY0LuIochKiPInv0tCQqMqqkOHIaeYuHgvm9IL-8GFJZU-wr2vzKhLqiCK3bYOHyuB29CcP7tq0wrxHchYNPFDt_cTwgFp9p9Q,,&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2224bd79-92a2-87a8-95f4-6617f4dbef7d&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=18/01/2014&type=hp1000
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=2224bd79-92a2-87a8-95f4-6617f4dbef7d&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=18/01/2014&type=hp1000
SearchScopes: HKU\S-1-5-21-1150857881-869180809-2020834858-1001 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb9UAVlpOoZG0nZc1hBPudVcZ_HOXVUaLWjyuTmFc_7tLSKeYcsPYPNYgm280VK60RlgY0LuIochKiPInv0tCQqMqqkOHIaeYuHgvm9IL-8GFJZU-wr2vzKhLqiCK3bYOHyuB29CcP7tq0wrxHchYNPFDt_cTwgFp9p9Q,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1150857881-869180809-2020834858-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAb9UAVlpOoZG0nZc1hBPudVcZ_HOXVUaLWjyuTmFc_7tLSKeYcsPYPNYgm280VK60RlgY0LuIochKiPInv0tCQqMqqkOHIaeYuHgvm9IL-8GFJZU-wr2vzKhLqiCK3bYOHyuB29CcP7tq0wrxHchYNPFDt_cTwgFp9p9Q,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1150857881-869180809-2020834858-1001 -> {A535CE12-75EF-4522-AF21-9B3EE64F121C} URL = 
BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
BHO-x32: Zonealarm Helper Object -> {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} -> C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\bh\zonealarm.dll (Check Point Software Technologies LTD)
BHO-x32: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\WINDOWS\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\zonealarmTlbr.dll (Check Point Software Technologies LTD)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\WINDOWS\SysWOW64\mscoree.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @checkpoint.com/FFApi -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-07-09] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 RGMUpdater; C:\Users\Thomas\AppData\Local\RGMService\RGMUpdater.exe [28160 2014-10-27] () [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-25] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-01] (Realtek Semiconductor)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445816 2013-10-25] (Check Point Software Technologies LTD)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [50704 2013-10-15] (Check Point Software Technologies, Ltd.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [610136 2012-11-15] (Kaspersky Lab)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-09-21] (Synaptics Incorporated)
R1 Vsdatant; C:\Windows\System32\drivers\vsdatant.sys [454168 2013-10-23] (Check Point Software Technologies LTD)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-28 23:31 - 2015-02-28 23:32 - 00018021 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-02-28 23:31 - 2015-02-28 23:31 - 00000000 ____D () C:\FRST
2015-02-28 23:29 - 2015-02-28 23:29 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-02-28 23:29 - 2015-02-28 23:29 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-02-28 23:27 - 2015-02-28 23:30 - 00000000 ____D () C:\Users\Thomas\Downloads\Adware
2015-02-28 23:21 - 2015-02-28 23:21 - 02087936 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-02-28 23:21 - 2015-02-28 23:21 - 00380416 _____ () C:\Users\Thomas\Desktop\1ojl221i.exe
2015-02-28 23:20 - 2015-02-28 23:20 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-02-19 18:20 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-19 18:20 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-16 13:00 - 2015-02-16 13:17 - 00000000 ____D () C:\ProgramData\softthinks
2015-02-16 13:00 - 2014-09-18 20:13 - 00000114 ____H () C:\DBAR_Ver.txt
2015-02-16 12:09 - 2015-02-16 12:09 - 00004028 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003484 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003216 _____ () C:\windows\System32\Tasks\SystemToolsDailyTest
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-16 12:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-02-16 12:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-16 12:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-16 12:06 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-02-16 12:06 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-16 12:06 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2015-02-16 12:06 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-16 12:06 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-16 12:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-16 12:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-16 12:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-16 12:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-16 12:05 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-16 12:05 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-16 12:05 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2015-02-16 12:05 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2015-02-16 12:05 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-16 12:05 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-16 12:05 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-16 12:05 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-16 12:05 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-16 12:05 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-16 12:05 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-02-16 12:05 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-02-16 12:05 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-02-16 12:03 - 2015-02-16 12:56 - 00000000 ____D () C:\ProgramData\HP
2015-02-14 14:32 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\windows\system32\sppobjs.dll
2015-02-14 14:31 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-04 09:30 - 2015-02-16 12:48 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-01 20:16 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2015-02-01 20:16 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-01 20:16 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-01 20:16 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-01-29 16:02 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-29 16:02 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ahcache.sys
2015-01-29 16:02 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-29 16:02 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
2015-01-29 16:02 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\windows\system32\ci.dll
2015-01-29 16:02 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll
2015-01-29 16:02 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\windows\system32\Faultrep.dll
2015-01-29 16:02 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\windows\SysWOW64\Faultrep.dll
2015-01-29 16:02 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-01-29 16:02 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\windows\system32\WerFaultSecure.exe
2015-01-29 16:02 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\windows\SysWOW64\WerFaultSecure.exe
2015-01-29 16:02 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\windows\system32\AudioEndpointBuilder.dll
2015-01-29 16:02 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\windows\system32\WerFault.exe
2015-01-29 16:02 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\windows\system32\wermgr.exe
2015-01-29 16:02 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2015-01-29 16:02 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2015-01-29 16:02 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2015-01-29 16:02 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
2015-01-29 16:02 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\windows\SysWOW64\WerFault.exe
2015-01-29 16:02 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\windows\SysWOW64\wermgr.exe
2015-01-29 16:02 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2015-01-29 16:02 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2015-01-29 16:02 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2015-01-29 16:02 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\werdiagcontroller.dll
2015-01-29 16:02 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\werdiagcontroller.dll
2015-01-29 16:02 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-01-29 16:00 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-29 16:00 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\windows\system32\ncsi.dll
2015-01-29 16:00 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-29 16:00 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\nlaapi.dll
2015-01-29 16:00 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-28 23:29 - 2014-01-02 21:16 - 00000000 ____D () C:\Users\Thomas
2015-02-28 23:25 - 2014-12-10 17:35 - 00000000 ____D () C:\Users\Thomas\AppData\Local\RGMService
2015-02-28 23:22 - 2013-04-09 19:41 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1150857881-869180809-2020834858-1001
2015-02-28 23:19 - 2014-01-26 16:26 - 00000000 ____D () C:\Users\Thomas\AppData\Local\DoNotTrackPlus
2015-02-28 23:17 - 2014-12-10 17:38 - 00001373 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-02-28 23:17 - 2014-12-10 17:36 - 00001348 _____ () C:\Users\Thomas\Desktop\Chrome.lnk
2015-02-28 23:11 - 2014-01-02 21:29 - 01157710 _____ () C:\windows\WindowsUpdate.log
2015-02-28 23:00 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sru
2015-02-28 22:54 - 2014-01-26 16:27 - 00003926 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{81BFCCB7-35B1-4144-92E6-6B85C9E70A66}
2015-02-28 22:52 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\AppReadiness
2015-02-19 18:29 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2015-02-16 13:18 - 2013-02-14 06:23 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-02-16 13:00 - 2013-04-10 03:49 - 00000000 ____D () C:\Users\Thomas\AppData\Local\softthinks
2015-02-16 12:59 - 2013-11-14 08:27 - 01780340 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-16 12:59 - 2013-11-14 08:11 - 00766620 _____ () C:\windows\system32\perfh007.dat
2015-02-16 12:59 - 2013-11-14 08:11 - 00159902 _____ () C:\windows\system32\perfc007.dat
2015-02-16 12:51 - 2014-01-02 21:34 - 00000000 ___DO () C:\Users\Thomas\SkyDrive
2015-02-16 12:49 - 2013-08-22 15:46 - 00300853 _____ () C:\windows\setupact.log
2015-02-16 12:49 - 2013-08-22 15:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-16 12:49 - 2013-08-22 15:44 - 00371656 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-16 12:48 - 2014-09-08 13:05 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-16 12:48 - 2013-08-22 14:25 - 00524288 ___SH () C:\windows\system32\config\BBI
2015-02-16 12:46 - 2013-08-18 18:25 - 00000000 ____D () C:\windows\system32\MRT
2015-02-16 12:45 - 2013-04-14 11:15 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-16 12:11 - 2013-12-01 18:33 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Vorlage
2015-02-16 12:09 - 2013-04-09 19:32 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Packages
2015-02-16 12:09 - 2013-02-14 06:25 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-16 12:09 - 2013-02-14 06:15 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-16 12:09 - 2013-02-14 06:09 - 00000000 ____D () C:\Program Files\Dell
2015-02-16 12:04 - 2013-08-22 16:36 - 00262144 _____ () C:\windows\system32\config\BCD-Template
2015-02-08 18:56 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\Recovery
2015-02-08 18:28 - 2013-11-13 23:18 - 00043464 _____ () C:\windows\PFRO.log
2015-02-04 09:30 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-01 21:05 - 2014-04-27 09:00 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Bökmann 2014
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-RS
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-CS
2015-02-01 15:58 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\LiveKernelReports

==================== Files in the root of some directories =======

2014-09-24 10:03 - 2014-09-24 10:04 - 0006656 _____ () C:\Users\Thomas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-14 06:19 - 2013-02-14 06:20 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-02-14 06:15 - 2013-02-14 06:16 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-02-14 06:16 - 2013-02-14 06:18 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2013-02-14 06:15 - 2013-02-14 06:15 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-02-14 06:18 - 2013-02-14 06:19 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

Some content of TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\e2gf0fb3.dll
C:\Users\Thomas\AppData\Local\Temp\hv9ng2gq.dll
C:\Users\Thomas\AppData\Local\Temp\lwiirngx.dll
C:\Users\Thomas\AppData\Local\Temp\nn2awmxz.dll
C:\Users\Thomas\AppData\Local\Temp\qjyzlzd5.dll
C:\Users\Thomas\AppData\Local\Temp\ys_v6b_u.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-01 16:02

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-02-2015 01
Ran by Thomas at 2015-02-28 23:32:22
Running from C:\Users\Thomas\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ZoneAlarm Free Firewall Antivirus (Enabled - Up to date) {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ZoneAlarm Free Firewall Anti-Spyware (Enabled - Up to date) {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
FW: ZoneAlarm Free Firewall Firewall (Enabled) {E6380B7E-D4B2-19F1-083E-56486607704B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
AMD Catalyst Install Manager (HKLM\...\{B9C542F2-31A8-8EC1-B349-28C74D2A865C}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
Chromium Browser (HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\Chromium) (Version: 41.0.2231.0 - Chrome)
CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.7.5.63 - Dell Inc.)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.16.1 - Dell Inc.)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 16.2.12.17 - Synaptics Incorporated)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3379 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{0728A184-F899-4356-B93D-8228674F0DEB}) (Version: 2.6.1209.0268 - Motorola Solutions, Inc.)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
PowerXpressHybrid (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.15.012 - Dell Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6741 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version:  - eTeks)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.6 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.6.2.0 - Intel)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Yahoo Community Smartbar (HKLM-x32\...\{D62304BE-D5D3-4CCF-8973-123909491ADB}) (Version: 11.62.66.17712 - Linkury Inc.) <==== ATTENTION
Yahoo Community Smartbar Engine (HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\{06f84728-9bce-4cfa-b3fc-69b924c5c756}) (Version: 11.62.66.17712 - Linkury Inc.) <==== ATTENTION
ZoneAlarm Antivirus (x32 Version: 11.0.000.057 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (x32 Version: 12.0.104.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 12.0.104.000 - Check Point)
ZoneAlarm LTD Toolbar (HKLM\...\ZoneAlarm LTD Toolbar) (Version:  - Check Point Software Technologies)
ZoneAlarm Security (x32 Version: 12.0.104.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Security Toolbar  (HKLM-x32\...\ZoneAlarm Security Toolbar) (Version: 1.8.22.0 - Check Point Software Technologies LTD)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-12-2014 06:00:18 Windows Modules Installer
18-01-2015 19:40:07 Geplanter Prüfpunkt
01-02-2015 17:17:16 Geplanter Prüfpunkt
14-02-2015 14:18:55 Windows Update
19-02-2015 18:28:18 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17143C45-F1EE-43EA-AFB0-A18161C4CFAF} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {4B62513D-E2C6-4DBC-B975-B77938BD63F3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-16] (Microsoft Corporation)
Task: {936819C1-9723-4BF5-A882-82059C645D74} - System32\Tasks\Dell\Dell System Registration => C:\Program Files (x86)\System Registration\prodreg.exe [2012-07-09] (Dell, Inc.)
Task: {B8A71C1B-63B8-4F91-862F-5D9A51D63648} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {C146BAAF-E489-4A00-8988-B0E5FBE67613} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: C:\windows\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) ==============

2014-10-27 16:04 - 2014-10-27 16:04 - 00028160 _____ () C:\Users\Thomas\AppData\Local\RGMService\RGMUpdater.exe
2014-12-01 17:01 - 2014-12-01 17:01 - 00974848 _____ () C:\Users\Thomas\AppData\Local\RGMService\RGMLoader.exe
2013-02-14 06:18 - 2012-04-25 03:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2013-12-21 00:02 - 2013-12-21 00:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-02-14 13:57 - 2012-09-21 01:40 - 04875576 _____ () C:\Program Files\Synaptics\SynTP\DellTouchpad.exe
2014-06-11 13:13 - 2014-06-11 13:13 - 00023832 _____ () C:\Users\Thomas\AppData\Local\LPT\srptm.exe
2014-09-18 20:37 - 2014-07-03 04:55 - 00487144 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
2014-11-30 09:45 - 2014-11-30 09:46 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\ErrorReporting.dll
2014-09-30 23:38 - 2014-09-30 23:38 - 00025088 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Lrcnta.exe
2014-12-01 17:01 - 2014-12-01 17:01 - 01686016 _____ () C:\Users\Thomas\AppData\Local\RGMService\RGMHost.dll
2014-12-01 17:01 - 2014-12-01 17:01 - 02745856 _____ () C:\Users\Thomas\AppData\Local\RGMService\MonetizationToolsManager.dll
2014-12-01 17:02 - 2014-12-01 17:02 - 01592832 _____ () C:\Users\Thomas\AppData\Local\RGMService\ProtectorsManager.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00052224 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00087552 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\srau.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00167424 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 02437632 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00068608 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\spbl.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00160256 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll
2014-09-30 23:38 - 2014-09-30 23:38 - 00015872 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\siem.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00069632 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\sppsm.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00698368 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00016384 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00080384 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00028672 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00072192 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\srut.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00031232 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\srsbs.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00067072 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00152064 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\smti.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00075264 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\smsp.dll
2014-09-30 23:38 - 2014-09-30 23:38 - 00011776 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\sidc.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00032256 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\smtu.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00040448 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\smta.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00032768 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\srom.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00049152 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\srbu.dll
2014-09-30 23:38 - 2014-09-30 23:38 - 00026112 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\sgml.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00063488 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00026624 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\srpdm.dll
2014-09-30 23:38 - 2014-09-30 23:38 - 00045056 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\MACTrackBarLib.dll
2014-09-30 23:33 - 2014-09-30 23:33 - 00026624 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00036864 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll
2014-09-30 23:39 - 2014-09-30 23:39 - 00257024 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\srns.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00077592 _____ () C:\Users\Thomas\AppData\Local\LPT\srpt.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00043288 _____ () C:\Users\Thomas\AppData\Local\LPT\srptc.dll
2014-06-11 13:11 - 2014-06-11 13:11 - 00018200 _____ () C:\Users\Thomas\AppData\Local\LPT\Smartbar.Common.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00060184 _____ () C:\Users\Thomas\AppData\Local\LPT\srut.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00066840 _____ () C:\Users\Thomas\AppData\Local\LPT\sppsm.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00156440 _____ () C:\Users\Thomas\AppData\Local\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll
2014-06-11 13:12 - 2014-06-11 13:12 - 00027928 _____ () C:\Users\Thomas\AppData\Local\LPT\Smartbar.Personalization.Common.dll
2014-06-11 13:12 - 2014-06-11 13:12 - 00166680 _____ () C:\Users\Thomas\AppData\Local\LPT\Smartbar.Infrastructure.Utilities.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00046872 _____ () C:\Users\Thomas\AppData\Local\LPT\srbu.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00025880 _____ () C:\Users\Thomas\AppData\Local\LPT\srpdm.dll
2014-06-11 13:11 - 2014-06-11 13:11 - 00026904 _____ () C:\Users\Thomas\AppData\Local\LPT\ProxySettings.dll
2014-06-11 13:12 - 2014-06-11 13:12 - 00046360 _____ () C:\Users\Thomas\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyService.dll
2014-06-11 13:11 - 2014-06-11 13:11 - 00053528 _____ () C:\Users\Thomas\AppData\Local\LPT\Proxy.Lib.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00028440 _____ () C:\Users\Thomas\AppData\Local\LPT\sreu.dll
2014-06-11 13:13 - 2014-06-11 13:13 - 00055064 _____ () C:\Users\Thomas\AppData\Local\LPT\srprl.dll
2014-06-11 13:11 - 2014-06-11 13:11 - 00049432 _____ () C:\Users\Thomas\AppData\Local\LPT\lrrot.dll
2013-02-14 06:16 - 2012-06-08 04:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 11:34 - 2012-06-08 11:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2012-08-10 15:51 - 2012-08-10 15:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2012-08-10 15:50 - 2012-08-10 15:50 - 00170496 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxslt.dll
2013-02-14 06:09 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-09-18 20:37 - 2014-07-31 00:37 - 01906464 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\STRestoreAPI.dll
2013-02-22 03:04 - 2012-11-26 05:19 - 01153384 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\libxml2.dll
2014-09-18 20:37 - 2012-11-26 06:19 - 00117608 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\zlib1.dll
2014-10-01 14:25 - 2015-02-16 12:52 - 00389632 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\Resources\crdli.dll
2014-06-11 13:11 - 2014-06-11 13:11 - 00317208 _____ () C:\Users\Thomas\AppData\Local\LPT\Resources\ntdis_32.dll
2014-12-10 17:36 - 2014-12-01 06:48 - 01409536 _____ () C:\Users\Thomas\AppData\Local\Chrome\Application\41.0.2231.0\libglesv2.dll
2014-12-10 17:36 - 2014-12-01 06:48 - 00223744 _____ () C:\Users\Thomas\AppData\Local\Chrome\Application\41.0.2231.0\libegl.dll
2014-12-10 17:36 - 2014-12-01 06:48 - 09528320 _____ () C:\Users\Thomas\AppData\Local\Chrome\Application\41.0.2231.0\pdf.dll
2014-09-30 23:38 - 2014-09-30 23:38 - 00034816 _____ () C:\Users\Thomas\AppData\Local\Smartbar\Application\lrcnt.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\windows\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade
AlternateDataStreams: C:\Users\Thomas\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Dell\Win LtBlue 1920x1200.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-1150857881-869180809-2020834858-500 - Administrator - Disabled)
Gast (S-1-5-21-1150857881-869180809-2020834858-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1150857881-869180809-2020834858-1003 - Limited - Enabled)
Thomas (S-1-5-21-1150857881-869180809-2020834858-1001 - Administrator - Enabled) => C:\Users\Thomas

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/28/2015 10:56:10 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\windows\system32\wbem\wmiaprpl.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: rdyboost4

Error: (02/28/2015 10:56:08 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: 

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: MSDTCC:\windows\system32\msdtcuiu.DLL4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: LsaC:\Windows\System32\Secur32.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: ESENTC:\windows\system32\esentprf.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll4

Error: (02/19/2015 07:54:08 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (02/16/2015 00:56:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350e0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebf2e
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000606c
ID des fehlerhaften Prozesses: 0x133c
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Vollständiger Name des fehlerhaften Pakets: CCC.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CCC.exe5


System errors:
=============
Error: (02/28/2015 10:51:22 PM) (Source: bowser) (EventID: 8016) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "THOMAS" auf Transport "NetBT_Tcpip_{502DC5DD-69CC-49B5-B041-F7D7F64B9C28}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.

Error: (02/19/2015 05:57:57 PM) (Source: bowser) (EventID: 8016) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "THOMAS" auf Transport "NetBT_Tcpip_{502DC5DD-69CC-49B5-B041-F7D7F64B9C28}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.

Error: (02/16/2015 00:48:55 PM) (Source: Application Popup) (EventID: 875) (User: )
Description: klif.sys

Error: (02/08/2015 06:52:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SoftThinks Agent Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/08/2015 06:29:13 PM) (Source: bowser) (EventID: 8016) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "THOMAS" auf Transport "NetBT_Tcpip_{502DC5DD-69CC-49B5-B041-F7D7F64B9C28}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.

Error: (02/08/2015 06:27:38 PM) (Source: Application Popup) (EventID: 875) (User: )
Description: klif.sys

Error: (02/04/2015 09:31:12 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll

Error: (02/04/2015 09:31:12 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll

Error: (02/04/2015 09:28:28 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll

Error: (02/04/2015 09:17:39 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll


Microsoft Office Sessions:
=========================
Error: (02/28/2015 10:56:10 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: WmiApRplC:\windows\system32\wbem\wmiaprpl.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: rdyboost4

Error: (02/28/2015 10:56:08 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: 

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: MSDTCC:\windows\system32\msdtcuiu.DLL4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: LsaC:\Windows\System32\Secur32.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: ESENTC:\windows\system32\esentprf.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll4

Error: (02/28/2015 10:56:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: .NETFrameworkC:\windows\system32\mscoree.dll4

Error: (02/19/2015 07:54:08 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (02/16/2015 00:56:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe3.5.0.04f8350e0KERNELBASE.dll6.3.9600.1727853eebf2ee0434352000000000000606c133c01d049defab0d111C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\windows\system32\KERNELBASE.dlld42fcdf3-b5d2-11e4-be9b-6036ddc18148


CodeIntegrity Errors:
===================================
  Date: 2013-11-03 16:17:58.893
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:16:55.612
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:16:55.581
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:03:44.481
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:57:01.363
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:54:58.245
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:40:03.269
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:31:45.638
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 18:47:58.893
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 18:39:49.989
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz
Percentage of memory in use: 32%
Total physical RAM: 8061.27 MB
Available physical RAM: 5469.98 MB
Total Pagefile: 9341.27 MB
Available Pagefile: 6548.69 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:916.28 GB) (Free:858.74 GB) NTFS
Drive e: (ESP) (Fixed) (Total:0.48 GB) (Free:0.44 GB) FAT32
Drive w: () (Fixed) (Total:0.34 GB) (Free:0.04 GB) NTFS
Drive x: (PBR Image) (Fixed) (Total:13.75 GB) (Free:0.27 GB) NTFS
Drive y: (WINRETOOLS) (Fixed) (Total:0.49 GB) (Free:0.22 GB) NTFS
Drive z: () (Fixed) (Total:0.34 GB) (Free:0.04 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: A40BCF23)

Partition: GPT Partition Type.

==================== End Of Log ============================

Bootsektor · 01.03.2015, 00:54

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
Poste die Logfiles direkt in deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:

Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Bitte alle Funde von Malwarebytes löschen lassen

Schritt 2
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3
Starte noch einmal FRST.

Setze den Haken bei addition.txt und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

PCOldie · 01.03.2015, 10:21

Hallo Sandra, danke für die schnelle Antwort.

MB erledigt,
AdwCleaner gestartet, nach dem Löschen keine Rückmeldung vom Programm.
Laptop neu gestartet, es wurde kurz das Logfile angezeigt, doch dann änderte sich der Inhalt in nur noch Hieroglyphen.

Hier die LOG's vom FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-02-2015 01
Ran by Thomas (administrator) on THOMAS on 01-03-2015 10:09:29
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available profiles: Thomas)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\Synaptics\SynTP\DellTouchpad.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Windows\System32\Magnify.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6842000 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1230992 2012-09-28] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [5757328 2012-10-19] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2918200 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [DellWPF] => C:\Program Files\Synaptics\SynTP\DellTouchpad.exe [4875576 2012-09-21] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-07-09] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-10-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [143888 2012-06-01] (CyberLink Corp.)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-10-25] (Check Point Software Technologies LTD)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe  --flag-switches-begin --flag-switches-end --restore-last-session https://www.facebook.com/n/?pages/&category=invites&ref=page_fan_invite_em (the data entry has 159 more characters).
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\MountPoints2: {a8542726-43bc-11e4-be97-6036ddc18148} - "E:\Startme.exe" 
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1150857881-869180809-2020834858-1001 -> {A535CE12-75EF-4522-AF21-9B3EE64F121C} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-07-09] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-25] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-01] (Realtek Semiconductor)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445816 2013-10-25] (Check Point Software Technologies LTD)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [50704 2013-10-15] (Check Point Software Technologies, Ltd.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [610136 2012-11-15] (Kaspersky Lab)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-09-21] (Synaptics Incorporated)
R1 Vsdatant; C:\Windows\System32\drivers\vsdatant.sys [454168 2013-10-23] (Check Point Software Technologies LTD)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 09:54 - 2015-03-01 09:57 - 00000000 ____D () C:\AdwCleaner
2015-03-01 09:53 - 2015-03-01 09:53 - 02126848 _____ () C:\Users\Thomas\Desktop\AdwCleaner_4.111.exe
2015-03-01 00:13 - 2015-03-01 00:13 - 00017738 _____ () C:\Users\Thomas\Desktop\MBAM-log-2015-02-28 (23-32-22).zip
2015-02-28 23:40 - 2015-02-28 23:40 - 00000000 ____D () C:\Users\Thomas\Documents\Meine empfangenen Dateien
2015-02-28 23:32 - 2015-03-01 09:38 - 00028560 _____ () C:\Users\Thomas\Desktop\Addition.txt
2015-02-28 23:31 - 2015-03-01 10:10 - 00012755 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-02-28 23:31 - 2015-03-01 10:09 - 00000000 ____D () C:\FRST
2015-02-28 23:29 - 2015-02-28 23:29 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-02-28 23:29 - 2015-02-28 23:29 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-02-28 23:27 - 2015-02-28 23:30 - 00000000 ____D () C:\Users\Thomas\Downloads\Adware
2015-02-28 23:21 - 2015-02-28 23:21 - 02087936 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-02-28 23:21 - 2015-02-28 23:21 - 00380416 _____ () C:\Users\Thomas\Desktop\1ojl221i.exe
2015-02-28 23:20 - 2015-02-28 23:20 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-02-19 18:20 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-19 18:20 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-16 13:00 - 2015-02-16 13:17 - 00000000 ____D () C:\ProgramData\softthinks
2015-02-16 13:00 - 2014-09-18 20:13 - 00000114 ____H () C:\DBAR_Ver.txt
2015-02-16 12:09 - 2015-02-16 12:09 - 00004028 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003484 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003216 _____ () C:\windows\System32\Tasks\SystemToolsDailyTest
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-16 12:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-02-16 12:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-16 12:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-16 12:06 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-02-16 12:06 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-16 12:06 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2015-02-16 12:06 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-16 12:06 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-16 12:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-16 12:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-16 12:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-16 12:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-16 12:05 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-16 12:05 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-16 12:05 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2015-02-16 12:05 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2015-02-16 12:05 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-16 12:05 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-16 12:05 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-16 12:05 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-16 12:05 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-16 12:05 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-16 12:05 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-02-16 12:05 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-02-16 12:05 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-02-16 12:03 - 2015-02-16 12:56 - 00000000 ____D () C:\ProgramData\HP
2015-02-14 14:32 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\windows\system32\sppobjs.dll
2015-02-14 14:31 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-04 09:30 - 2015-02-16 12:48 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-01 20:16 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2015-02-01 20:16 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-01 20:16 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-01 20:16 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 10:10 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sru
2015-03-01 10:07 - 2013-02-14 06:23 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-01 10:05 - 2014-01-02 21:34 - 00000000 __RDO () C:\Users\Thomas\SkyDrive
2015-03-01 10:05 - 2014-01-02 21:16 - 00000000 ____D () C:\Users\Thomas
2015-03-01 10:04 - 2013-08-22 15:46 - 00301007 _____ () C:\windows\setupact.log
2015-03-01 10:04 - 2013-08-22 15:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-03-01 09:58 - 2014-01-02 21:29 - 01294973 _____ () C:\windows\WindowsUpdate.log
2015-03-01 09:49 - 2014-01-26 16:27 - 00003926 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{81BFCCB7-35B1-4144-92E6-6B85C9E70A66}
2015-03-01 09:34 - 2013-11-14 08:27 - 01780340 _____ () C:\windows\system32\PerfStringBackup.INI
2015-03-01 09:34 - 2013-11-14 08:11 - 00766620 _____ () C:\windows\system32\perfh007.dat
2015-03-01 09:34 - 2013-11-14 08:11 - 00159902 _____ () C:\windows\system32\perfc007.dat
2015-03-01 09:27 - 2013-11-13 23:18 - 00382060 _____ () C:\windows\PFRO.log
2015-03-01 09:27 - 2013-08-22 14:25 - 00524288 ___SH () C:\windows\system32\config\BBI
2015-03-01 00:18 - 2013-04-09 19:41 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1150857881-869180809-2020834858-1001
2015-02-28 23:19 - 2014-01-26 16:26 - 00000000 ____D () C:\Users\Thomas\AppData\Local\DoNotTrackPlus
2015-02-28 23:17 - 2014-12-10 17:38 - 00001373 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-02-28 23:17 - 2014-12-10 17:36 - 00001348 _____ () C:\Users\Thomas\Desktop\Chrome.lnk
2015-02-28 22:52 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\AppReadiness
2015-02-19 18:29 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2015-02-16 13:00 - 2013-04-10 03:49 - 00000000 ____D () C:\Users\Thomas\AppData\Local\softthinks
2015-02-16 12:49 - 2013-08-22 15:44 - 00371656 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-16 12:48 - 2014-09-08 13:05 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-16 12:46 - 2013-08-18 18:25 - 00000000 ____D () C:\windows\system32\MRT
2015-02-16 12:45 - 2013-04-14 11:15 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-16 12:11 - 2013-12-01 18:33 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Vorlage
2015-02-16 12:09 - 2013-04-09 19:32 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Packages
2015-02-16 12:09 - 2013-02-14 06:25 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-16 12:09 - 2013-02-14 06:15 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-16 12:09 - 2013-02-14 06:09 - 00000000 ____D () C:\Program Files\Dell
2015-02-16 12:04 - 2013-08-22 16:36 - 00262144 _____ () C:\windows\system32\config\BCD-Template
2015-02-08 18:56 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\Recovery
2015-02-04 09:30 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-01 21:05 - 2014-04-27 09:00 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Bökmann 2014
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-RS
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-CS
2015-02-01 15:58 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\LiveKernelReports

==================== Files in the root of some directories =======

2014-09-24 10:03 - 2014-09-24 10:04 - 0006656 _____ () C:\Users\Thomas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-14 06:19 - 2013-02-14 06:20 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-02-14 06:15 - 2013-02-14 06:16 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-02-14 06:16 - 2013-02-14 06:18 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2013-02-14 06:15 - 2013-02-14 06:15 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-02-14 06:18 - 2013-02-14 06:19 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

Some content of TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\e2gf0fb3.dll
C:\Users\Thomas\AppData\Local\Temp\hv9ng2gq.dll
C:\Users\Thomas\AppData\Local\Temp\lwiirngx.dll
C:\Users\Thomas\AppData\Local\Temp\nn2awmxz.dll
C:\Users\Thomas\AppData\Local\Temp\qjyzlzd5.dll
C:\Users\Thomas\AppData\Local\Temp\ys_v6b_u.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-01 16:02

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-02-2015 01
Ran by Thomas at 2015-03-01 10:10:34
Running from C:\Users\Thomas\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ZoneAlarm Free Firewall Antivirus (Enabled - Up to date) {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ZoneAlarm Free Firewall Anti-Spyware (Enabled - Up to date) {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
FW: ZoneAlarm Free Firewall Firewall (Enabled) {E6380B7E-D4B2-19F1-083E-56486607704B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
AMD Catalyst Install Manager (HKLM\...\{B9C542F2-31A8-8EC1-B349-28C74D2A865C}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
Chromium Browser (HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\Chromium) (Version: 41.0.2231.0 - Chrome)
CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.7.5.63 - Dell Inc.)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.16.1 - Dell Inc.)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 16.2.12.17 - Synaptics Incorporated)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3379 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{0728A184-F899-4356-B93D-8228674F0DEB}) (Version: 2.6.1209.0268 - Motorola Solutions, Inc.)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
PowerXpressHybrid (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.15.012 - Dell Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6741 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version:  - eTeks)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.6 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.6.2.0 - Intel)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Yahoo Community Smartbar Engine (HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\{06f84728-9bce-4cfa-b3fc-69b924c5c756}) (Version: 11.62.66.17712 - Linkury Inc.) <==== ATTENTION
ZoneAlarm Antivirus (x32 Version: 11.0.000.057 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (x32 Version: 12.0.104.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 12.0.104.000 - Check Point)
ZoneAlarm Security (x32 Version: 12.0.104.000 - Check Point Software Technologies Ltd.) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

02-12-2014 06:00:18 Windows Modules Installer
18-01-2015 19:40:07 Geplanter Prüfpunkt
01-02-2015 17:17:16 Geplanter Prüfpunkt
14-02-2015 14:18:55 Windows Update
19-02-2015 18:28:18 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17143C45-F1EE-43EA-AFB0-A18161C4CFAF} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {4B62513D-E2C6-4DBC-B975-B77938BD63F3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-16] (Microsoft Corporation)
Task: {936819C1-9723-4BF5-A882-82059C645D74} - System32\Tasks\Dell\Dell System Registration => C:\Program Files (x86)\System Registration\prodreg.exe [2012-07-09] (Dell, Inc.)
Task: {B8A71C1B-63B8-4F91-862F-5D9A51D63648} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {C146BAAF-E489-4A00-8988-B0E5FBE67613} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: C:\windows\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) ==============

2013-02-14 06:18 - 2012-04-25 03:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2013-12-21 00:02 - 2013-12-21 00:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-02-14 13:57 - 2012-09-21 01:40 - 04875576 _____ () C:\Program Files\Synaptics\SynTP\DellTouchpad.exe
2013-02-14 06:16 - 2012-06-08 04:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 11:34 - 2012-06-08 11:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2012-08-10 15:51 - 2012-08-10 15:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2013-02-14 06:09 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\windows\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade
AlternateDataStreams: C:\Users\Thomas\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Dell\Win LtBlue 1920x1200.jpg
DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-1150857881-869180809-2020834858-500 - Administrator - Disabled)
Gast (S-1-5-21-1150857881-869180809-2020834858-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1150857881-869180809-2020834858-1003 - Limited - Enabled)
Thomas (S-1-5-21-1150857881-869180809-2020834858-1001 - Administrator - Enabled) => C:\Users\Thomas

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/01/2015 10:06:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350e0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebf2e
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000606c
ID des fehlerhaften Prozesses: 0x1368
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Vollständiger Name des fehlerhaften Pakets: CCC.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CCC.exe5

Error: (03/01/2015 10:06:17 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/01/2015 09:36:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ERUNT.exe, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Name des fehlerhaften Moduls: ERUNT.exe, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Ausnahmecode: 0xc000041d
Fehleroffset: 0x00042fd8
ID des fehlerhaften Prozesses: 0xf9c
Startzeit der fehlerhaften Anwendung: 0xERUNT.exe0
Pfad der fehlerhaften Anwendung: ERUNT.exe1
Pfad des fehlerhaften Moduls: ERUNT.exe2
Berichtskennung: ERUNT.exe3
Vollständiger Name des fehlerhaften Pakets: ERUNT.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ERUNT.exe5

Error: (03/01/2015 09:36:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ERUNT.exe, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Name des fehlerhaften Moduls: ERUNT.exe, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00042fd8
ID des fehlerhaften Prozesses: 0xf9c
Startzeit der fehlerhaften Anwendung: 0xERUNT.exe0
Pfad der fehlerhaften Anwendung: ERUNT.exe1
Pfad des fehlerhaften Moduls: ERUNT.exe2
Berichtskennung: ERUNT.exe3
Vollständiger Name des fehlerhaften Pakets: ERUNT.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ERUNT.exe5

Error: (03/01/2015 09:31:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350e0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebf2e
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000606c
ID des fehlerhaften Prozesses: 0xbb4
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Vollständiger Name des fehlerhaften Pakets: CCC.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CCC.exe5

Error: (03/01/2015 09:31:57 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/01/2015 09:14:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350e0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebf2e
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000606c
ID des fehlerhaften Prozesses: 0x198
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Vollständiger Name des fehlerhaften Pakets: CCC.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CCC.exe5

Error: (03/01/2015 09:14:58 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/01/2015 00:19:48 AM) (Source: TOASTER.EXE) (EventID: 0) (User: )
Description: An Unhandled Exception occured.
Breite und Höhe dürfen keine negative Zahl sein.
   bei Toaster.Core.AppBarFunctions.ABSetPos(ABEdge edge, Window appbarWindow)
   bei Toaster.Core.AppBarFunctions.RegisterInfo.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   bei System.Windows.Interop.HwndSource.PublicHooksFilterMessage(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(Object o)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(Object source, Delegate method, Object args, Int32 numArgs, Delegate catchHandler)

Error: (02/28/2015 11:42:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm rundll32.exe, Version 6.3.9600.16384 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2cdc

Startzeit: 01d053a788daff35

Endzeit: 4294967295

Anwendungspfad: C:\windows\system32\rundll32.exe

Berichts-ID: 1c5ac209-bf9b-11e4-be9b-6036ddc18148

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


System errors:
=============
Error: (03/01/2015 10:03:59 AM) (Source: Application Popup) (EventID: 875) (User: )
Description: klif.sys

Error: (03/01/2015 10:04:33 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎01.‎03.‎2015 um 09:52:43 unerwartet heruntergefahren.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SoftThinks Agent Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage-Technologie" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/01/2015 09:57:53 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel® Centrino® Wireless Bluetooth® + High Speed Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/01/2015 09:57:53 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Bluetooth OBEX Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/01/2015 09:57:53 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (03/01/2015 10:06:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe3.5.0.04f8350e0KERNELBASE.dll6.3.9600.1727853eebf2ee0434352000000000000606c136801d053feef2fe8e5C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\windows\system32\KERNELBASE.dll38827bae-bff2-11e4-be9d-6036ddc18148

Error: (03/01/2015 10:06:17 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/01/2015 09:36:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ERUNT.exe0.0.0.02a425e19ERUNT.exe0.0.0.02a425e19c000041d00042fd8f9c01d053fadd05ebbbC:\WINDOWS\ERUNT.exeC:\WINDOWS\ERUNT.exe1ddf1f9c-bfee-11e4-be9c-6036ddc18148

Error: (03/01/2015 09:36:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ERUNT.exe0.0.0.02a425e19ERUNT.exe0.0.0.02a425e19c000000500042fd8f9c01d053fadd05ebbbC:\WINDOWS\ERUNT.exeC:\WINDOWS\ERUNT.exe1d8dcc82-bfee-11e4-be9c-6036ddc18148

Error: (03/01/2015 09:31:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe3.5.0.04f8350e0KERNELBASE.dll6.3.9600.1727853eebf2ee0434352000000000000606cbb401d053f9c6123806C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\windows\system32\KERNELBASE.dll6c4679b2-bfed-11e4-be9c-6036ddc18148

Error: (03/01/2015 09:31:57 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/01/2015 09:14:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe3.5.0.04f8350e0KERNELBASE.dll6.3.9600.1727853eebf2ee0434352000000000000606c19801d053f6f61ea4dcC:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\windows\system32\KERNELBASE.dll0cad8924-bfeb-11e4-be9b-6036ddc18148

Error: (03/01/2015 09:14:58 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/01/2015 00:19:48 AM) (Source: TOASTER.EXE) (EventID: 0) (User: )
Description: An Unhandled Exception occured.
Breite und Höhe dürfen keine negative Zahl sein.
   bei Toaster.Core.AppBarFunctions.ABSetPos(ABEdge edge, Window appbarWindow)
   bei Toaster.Core.AppBarFunctions.RegisterInfo.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   bei System.Windows.Interop.HwndSource.PublicHooksFilterMessage(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   bei MS.Win32.HwndWrapper.WndProc(IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam, Boolean& handled)
   bei MS.Win32.HwndSubclass.DispatcherCallbackOperation(Object o)
   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Int32 numArgs)
   bei MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(Object source, Delegate method, Object args, Int32 numArgs, Delegate catchHandler)

Error: (02/28/2015 11:42:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rundll32.exe6.3.9600.163842cdc01d053a788daff354294967295C:\windows\system32\rundll32.exe1c5ac209-bf9b-11e4-be9b-6036ddc18148


CodeIntegrity Errors:
===================================
  Date: 2013-11-03 16:17:58.893
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:16:55.612
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:16:55.581
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:03:44.481
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:57:01.363
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:54:58.245
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:40:03.269
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:31:45.638
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 18:47:58.893
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 18:39:49.989
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz
Percentage of memory in use: 18%
Total physical RAM: 8061.27 MB
Available physical RAM: 6583.65 MB
Total Pagefile: 9341.27 MB
Available Pagefile: 7830 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:916.28 GB) (Free:858.43 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: A40BCF23)

Partition: GPT Partition Type.

==================== End Of Log ============================

Bootsektor · 01.03.2015, 21:24

Hallo,

wie sieht es denn nach all diesen Schritten aus?

Bitte auch noch das Log von Malwarebytes posten:

Schritt 1

Starte Malwarebytes
Gehe nun oben auf Verlauf
links findest du nun die Auswahl Quarantäne und Anwendungsprotokolle
Gehe auf Anwendungsprotokolle
suche hier das letzte Suchlaufsprotokoll und wähle das aus
nun gehe oben auf Ansicht, das Protokoll öffnet sich
unten links steht exportieren, wähle das aus und klicke auf Textdatei
speichere nun das Log unter mbam.txt ab
öffne das Log mit deinem Texteditor
poste mir den Inhalt

Schritt 2
und das vom Adwarecleaner sollte sich unter C:\AdwCleaner\AdwCleaner[Sx].txt befinden, das x bezeichnet die laufende Nummer.

Schritt 3
Bitte deinstalliere folgende Programme:
Yahoo Community Smartbar Engine
Dazu drücke auf:
Windowstaste und X
dann:
Programme und Funktionen --> Programm auswählen --> entfernen

Falls du ein Programm nicht deinstallieren kannst, lade dir von hier den Revo-uninstaller herunter und deinstalliere es damit, wähle dabei den moderaten Modus.

Schritt 4

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1150857881-869180809-2020834858-1001 -> {A535CE12-75EF-4522-AF21-9B3EE64F121C} URL =

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 5
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

PCOldie · 01.03.2015, 23:05

Hallo Sandra,

so alle Schritte ausgeführt.

Hier die LOG's,

Gruß PCOldie

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2015.02.28.06

Windows 8 x64 NTFS
Internet Explorer 11.0.9600.17631
Thomas :: THOMAS [Administrator]

01.03.2015 09:30:20
mbam-log-2015-03-01 (09-30-20).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 343288
Laufzeit: 6 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:

ATTFilter

# AdwCleaner v4.111 - Bericht erstellt 01/03/2015 um 09:57:51
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-02-18.3 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Thomas - THOMAS
# Gestarted von : C:\Users\Thomas\Desktop\AdwCleaner_4.111.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Check Point Software Technologies LTD
Ordner Gelöscht : C:\windows\SysWOW64\ARFC
Ordner Gelöscht : C:\windows\SysWOW64\WNLT
Ordner Gelöscht : C:\Users\Thomas\AppData\LocalLow\Check Point Software Technologies LTD
Ordner Gelöscht : C:\Users\Thomas\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Ordner Gelöscht : C:\Users\Thomas\AppData\Roaming\Check Point Software Technologies LTD

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Thomas\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Chrome.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F1963E76-845B-474C-8C7F-D69A96D8AA34}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D62304BE-D5D3-4CCF-8973-123909491ADB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\Users\Thomas\AppData\Local\Smartbar\Application\Resources\crdlil64.dll
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


*************************

AdwCleaner[R0].txt - [8150 Bytes] - [01/03/2015 09:56:11]
AdwCleaner[S0].txt - [8037 Bytes] - [01/03/2015 09:57:51]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8096  Bytes] ##########

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-02-2015
Ran by Thomas at 2015-03-01 22:50:49 Run:1
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available profiles: Thomas)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1150857881-869180809-2020834858-1001 -> {A535CE12-75EF-4522-AF21-9B3EE64F121C} URL =
         
*****************

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-1150857881-869180809-2020834858-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A535CE12-75EF-4522-AF21-9B3EE64F121C}" => Key deleted successfully.
HKCR\CLSID\{A535CE12-75EF-4522-AF21-9B3EE64F121C} => Key not found. 

==== End of Fixlog 22:50:49 ====

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by Thomas (administrator) on THOMAS on 01-03-2015 22:52:33
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available profiles: Thomas)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\Synaptics\SynTP\DellTouchpad.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssist\uaclauncher.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6842000 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1230992 2012-09-28] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [5757328 2012-10-19] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2918200 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [DellWPF] => C:\Program Files\Synaptics\SynTP\DellTouchpad.exe [4875576 2012-09-21] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-07-09] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-10-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [143888 2012-06-01] (CyberLink Corp.)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-10-25] (Check Point Software Technologies LTD)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe  --flag-switches-begin --flag-switches-end --restore-last-session https://www.facebook.com/n/?pages/&category=invites&ref=page_fan_invite_em (the data entry has 159 more characters).
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\MountPoints2: {a8542726-43bc-11e4-be97-6036ddc18148} - "E:\Startme.exe" 
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-07-09] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-25] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-01] (Realtek Semiconductor)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445816 2013-10-25] (Check Point Software Technologies LTD)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [50704 2013-10-15] (Check Point Software Technologies, Ltd.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [610136 2012-11-15] (Kaspersky Lab)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-09-21] (Synaptics Incorporated)
R1 Vsdatant; C:\Windows\System32\drivers\vsdatant.sys [454168 2013-10-23] (Check Point Software Technologies LTD)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 22:50 - 2015-03-01 22:50 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion
2015-03-01 22:43 - 2015-03-01 22:43 - 00001282 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk
2015-03-01 22:43 - 2015-03-01 22:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-01 22:42 - 2015-03-01 22:43 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe
2015-03-01 22:41 - 2015-03-01 22:41 - 00002090 _____ () C:\Users\Thomas\Desktop\mbam.txt
2015-03-01 09:57 - 2015-03-01 09:57 - 00008236 _____ () C:\Users\Thomas\Desktop\AdwCleaner[S0].txt
2015-03-01 09:56 - 2015-03-01 09:57 - 00008150 _____ () C:\Users\Thomas\Desktop\AdwCleaner[R0].txt
2015-03-01 09:54 - 2015-03-01 22:37 - 00000000 ____D () C:\AdwCleaner
2015-03-01 09:53 - 2015-03-01 09:53 - 02126848 _____ () C:\Users\Thomas\Desktop\AdwCleaner_4.111.exe
2015-02-28 23:40 - 2015-02-28 23:40 - 00000000 ____D () C:\Users\Thomas\Documents\Meine empfangenen Dateien
2015-02-28 23:32 - 2015-03-01 10:10 - 00029726 _____ () C:\Users\Thomas\Desktop\Addition.txt
2015-02-28 23:31 - 2015-03-01 22:52 - 00012383 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-02-28 23:31 - 2015-03-01 22:52 - 00000000 ____D () C:\FRST
2015-02-28 23:29 - 2015-02-28 23:29 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-02-28 23:29 - 2015-02-28 23:29 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-02-28 23:27 - 2015-02-28 23:30 - 00000000 ____D () C:\Users\Thomas\Downloads\Adware
2015-02-28 23:21 - 2015-03-01 22:50 - 02092544 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-02-28 23:21 - 2015-02-28 23:21 - 00380416 _____ () C:\Users\Thomas\Desktop\1ojl221i.exe
2015-02-28 23:20 - 2015-02-28 23:20 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-02-19 18:20 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-19 18:20 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-16 13:00 - 2015-02-16 13:17 - 00000000 ____D () C:\ProgramData\softthinks
2015-02-16 13:00 - 2014-09-18 20:13 - 00000114 ____H () C:\DBAR_Ver.txt
2015-02-16 12:09 - 2015-02-16 12:09 - 00004028 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003484 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003216 _____ () C:\windows\System32\Tasks\SystemToolsDailyTest
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-16 12:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-02-16 12:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-16 12:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-16 12:06 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-02-16 12:06 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-16 12:06 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2015-02-16 12:06 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-16 12:06 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-16 12:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-16 12:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-16 12:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-16 12:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-16 12:05 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-16 12:05 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-16 12:05 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2015-02-16 12:05 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2015-02-16 12:05 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-16 12:05 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-16 12:05 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-16 12:05 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-16 12:05 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-16 12:05 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-16 12:05 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-02-16 12:05 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-02-16 12:05 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-02-16 12:03 - 2015-02-16 12:56 - 00000000 ____D () C:\ProgramData\HP
2015-02-14 14:32 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\windows\system32\sppobjs.dll
2015-02-14 14:31 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-04 09:30 - 2015-02-16 12:48 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-01 20:16 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2015-02-01 20:16 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-01 20:16 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-01 20:16 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 22:50 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\AppReadiness
2015-03-01 22:49 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2015-03-01 22:48 - 2013-04-09 19:41 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1150857881-869180809-2020834858-1001
2015-03-01 22:37 - 2013-02-14 06:23 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-01 22:36 - 2014-01-02 21:34 - 00000000 __RDO () C:\Users\Thomas\SkyDrive
2015-03-01 22:34 - 2014-01-26 16:27 - 00003926 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{81BFCCB7-35B1-4144-92E6-6B85C9E70A66}
2015-03-01 22:31 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sru
2015-03-01 10:21 - 2014-01-02 21:16 - 00000000 ____D () C:\Users\Thomas
2015-03-01 10:04 - 2013-08-22 15:46 - 00301007 _____ () C:\windows\setupact.log
2015-03-01 10:04 - 2013-08-22 15:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-03-01 09:58 - 2014-01-02 21:29 - 01397357 _____ () C:\windows\WindowsUpdate.log
2015-03-01 09:34 - 2013-11-14 08:27 - 01780340 _____ () C:\windows\system32\PerfStringBackup.INI
2015-03-01 09:34 - 2013-11-14 08:11 - 00766620 _____ () C:\windows\system32\perfh007.dat
2015-03-01 09:34 - 2013-11-14 08:11 - 00159902 _____ () C:\windows\system32\perfc007.dat
2015-03-01 09:27 - 2013-11-13 23:18 - 00382060 _____ () C:\windows\PFRO.log
2015-03-01 09:27 - 2013-08-22 14:25 - 00524288 ___SH () C:\windows\system32\config\BBI
2015-02-28 23:19 - 2014-01-26 16:26 - 00000000 ____D () C:\Users\Thomas\AppData\Local\DoNotTrackPlus
2015-02-28 23:17 - 2014-12-10 17:38 - 00001373 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-02-28 23:17 - 2014-12-10 17:36 - 00001348 _____ () C:\Users\Thomas\Desktop\Chrome.lnk
2015-02-16 13:00 - 2013-04-10 03:49 - 00000000 ____D () C:\Users\Thomas\AppData\Local\softthinks
2015-02-16 12:49 - 2013-08-22 15:44 - 00371656 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-16 12:48 - 2014-09-08 13:05 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-16 12:46 - 2013-08-18 18:25 - 00000000 ____D () C:\windows\system32\MRT
2015-02-16 12:45 - 2013-04-14 11:15 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-16 12:11 - 2013-12-01 18:33 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Vorlage
2015-02-16 12:09 - 2013-04-09 19:32 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Packages
2015-02-16 12:09 - 2013-02-14 06:25 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-16 12:09 - 2013-02-14 06:15 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-16 12:09 - 2013-02-14 06:09 - 00000000 ____D () C:\Program Files\Dell
2015-02-16 12:04 - 2013-08-22 16:36 - 00262144 _____ () C:\windows\system32\config\BCD-Template
2015-02-08 18:56 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\Recovery
2015-02-04 09:30 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-01 21:05 - 2014-04-27 09:00 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Bökmann 2014
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-RS
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-CS
2015-02-01 15:58 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\LiveKernelReports

==================== Files in the root of some directories =======

2014-09-24 10:03 - 2014-09-24 10:04 - 0006656 _____ () C:\Users\Thomas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-14 06:19 - 2013-02-14 06:20 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-02-14 06:15 - 2013-02-14 06:16 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-02-14 06:16 - 2013-02-14 06:18 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2013-02-14 06:15 - 2013-02-14 06:15 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-02-14 06:18 - 2013-02-14 06:19 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

Some content of TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\e2gf0fb3.dll
C:\Users\Thomas\AppData\Local\Temp\hv9ng2gq.dll
C:\Users\Thomas\AppData\Local\Temp\lwiirngx.dll
C:\Users\Thomas\AppData\Local\Temp\nn2awmxz.dll
C:\Users\Thomas\AppData\Local\Temp\qjyzlzd5.dll
C:\Users\Thomas\AppData\Local\Temp\ys_v6b_u.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-01 16:02

==================== End Of Log ============================

--- --- ---

--- --- ---

Bootsektor · 01.03.2015, 23:12

Hallo,

ok, wie schaut es denn nun aus?

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Starte noch einmal FRST.

Setze den Haken bei addition.txt und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

PCOldie · 02.03.2015, 08:52

Hallo Sandra,
so ich habe die weiteren Schritte ausgeführt.

Der Online Scanner hat da noch etwas gefunden, nach ein paar Stunden suche

Hier die LOG's

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-02-2015
Ran by Thomas at 2015-03-01 23:49:12 Run:2
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available profiles: Thomas)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
emptytemp:
         
*****************

EmptyTemp: => Removed 578.8 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 23:49:37 ====

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=d16976b7f79f51459d22d8d569d7855d
# engine=22704
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-02 06:56:09
# local_time=2015-03-02 07:56:09 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 8881575 61986435 0 0
# scanned=204899
# found=9
# cleaned=0
# scan_time=28512
sh=83AF8438702BC3B8C19C1D5DF45125F58351A558 ft=1 fh=2d34ad7ad94c7467 vn="Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\uninstall.exe.vir"
sh=7D88383C44FDAA38E0D29B63F997635CDE9BF1DC ft=1 fh=c71c00111b20784d vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\zonealarmApp.dll.vir"
sh=BC1E722817649F418D69AC649F876A51678080AD ft=1 fh=c71c0011931c2410 vn="Variante von Win32/Toolbar.Montiera.U evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\zonealarmEng.dll.vir"
sh=218D826DF7CEFCE7B428F53A7ACDF10F50F026C2 ft=1 fh=8db84d6f75cab766 vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\zonealarmsrv.exe.vir"
sh=839C7BD3E480D2B2E52EBB7784DA99FBEF0BE1B3 ft=1 fh=087cc1d5e496e287 vn="Variante von Win32/Toolbar.Montiera.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\zonealarmTlbr.dll.vir"
sh=7A219354FC60B0CF6ED52E610C3140CE704CC656 ft=1 fh=83737b1a97540dba vn="Variante von Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\bh\zonealarm.dll.vir"
sh=C25E453070C795849C94FCB0311ED1DDD4F7B74D ft=1 fh=a07ba6255bd749e6 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\CheckPoint\Install\CUninstallerZA.exe"
sh=28F81FA9CC2F237BB3DCB5F2D9E43DBB64E6CB34 ft=1 fh=51b4fcd41bbc33f1 vn="Win32/Toolbar.Montiera.I evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\CheckPoint\Install\zatb.exe"
sh=8E11576A2D99F0900DF7B767B216F3813170EB97 ft=1 fh=103cd6974b4c4f5b vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll"

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by Thomas (administrator) on THOMAS on 02-03-2015 08:44:35
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available profiles: Thomas)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
() C:\Program Files\Synaptics\SynTP\DellTouchpad.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(The Chromium Authors) C:\Users\Thomas\AppData\Local\Chrome\Application\chrome.exe
(The Chromium Authors) C:\Users\Thomas\AppData\Local\Chrome\Application\chrome.exe
(The Chromium Authors) C:\Users\Thomas\AppData\Local\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6842000 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1230992 2012-09-28] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [5757328 2012-10-19] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2918200 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [DellWPF] => C:\Program Files\Synaptics\SynTP\DellTouchpad.exe [4875576 2012-09-21] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-07-09] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-10-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [143888 2012-06-01] (CyberLink Corp.)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-10-25] (Check Point Software Technologies LTD)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe  --flag-switches-begin --flag-switches-end --restore-last-session https://www.facebook.com/n/?pages/&category=invites&ref=page_fan_invite_em (the data entry has 159 more characters).
HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\MountPoints2: {a8542726-43bc-11e4-be97-6036ddc18148} - "E:\Startme.exe" 
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-07-09] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-25] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-01] (Realtek Semiconductor)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1924328 2014-09-18] (SoftThinks SAS)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445816 2013-10-25] (Check Point Software Technologies LTD)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [50704 2013-10-15] (Check Point Software Technologies, Ltd.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [610136 2012-11-15] (Kaspersky Lab)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-09-21] (Synaptics Incorporated)
R1 Vsdatant; C:\Windows\System32\drivers\vsdatant.sys [454168 2013-10-23] (Check Point Software Technologies LTD)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 23:56 - 2015-03-01 23:56 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-01 23:55 - 2015-03-01 23:55 - 02347384 _____ (ESET) C:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe
2015-03-01 22:50 - 2015-03-01 22:50 - 00000000 ____D () C:\Users\Thomas\Desktop\FRST-OlderVersion
2015-03-01 22:50 - 2014-12-13 22:28 - 00513488 _____ () C:\windows\SysWOW64\locale.nls
2015-03-01 22:50 - 2014-12-13 22:28 - 00513488 _____ () C:\windows\system32\locale.nls
2015-03-01 22:50 - 2014-10-29 02:27 - 01200128 _____ (Microsoft Corporation) C:\windows\system32\Windows.Globalization.dll
2015-03-01 22:50 - 2014-10-29 02:27 - 00323072 _____ (Microsoft Corporation) C:\windows\system32\GlobCollationHost.dll
2015-03-01 22:50 - 2014-10-29 02:04 - 00868352 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Globalization.dll
2015-03-01 22:50 - 2014-10-29 02:04 - 00200704 _____ (Microsoft Corporation) C:\windows\SysWOW64\GlobCollationHost.dll
2015-03-01 22:43 - 2015-03-01 22:43 - 00001282 _____ () C:\Users\Thomas\Desktop\Revo Uninstaller.lnk
2015-03-01 22:43 - 2015-03-01 22:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-01 22:42 - 2015-03-01 22:43 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Thomas\Desktop\revosetup95.exe
2015-03-01 22:41 - 2015-03-01 22:41 - 00002090 _____ () C:\Users\Thomas\Desktop\mbam.txt
2015-03-01 09:57 - 2015-03-01 09:57 - 00008236 _____ () C:\Users\Thomas\Desktop\AdwCleaner[S0].txt
2015-03-01 09:56 - 2015-03-01 09:57 - 00008150 _____ () C:\Users\Thomas\Desktop\AdwCleaner[R0].txt
2015-03-01 09:54 - 2015-03-01 22:37 - 00000000 ____D () C:\AdwCleaner
2015-03-01 09:53 - 2015-03-01 09:53 - 02126848 _____ () C:\Users\Thomas\Desktop\AdwCleaner_4.111.exe
2015-02-28 23:40 - 2015-02-28 23:40 - 00000000 ____D () C:\Users\Thomas\Documents\Meine empfangenen Dateien
2015-02-28 23:32 - 2015-03-01 10:10 - 00029726 _____ () C:\Users\Thomas\Desktop\Addition.txt
2015-02-28 23:31 - 2015-03-02 08:45 - 00012602 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-02-28 23:31 - 2015-03-02 08:44 - 00000000 ____D () C:\FRST
2015-02-28 23:29 - 2015-02-28 23:29 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-02-28 23:29 - 2015-02-28 23:29 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-02-28 23:27 - 2015-02-28 23:30 - 00000000 ____D () C:\Users\Thomas\Downloads\Adware
2015-02-28 23:21 - 2015-03-01 22:50 - 02092544 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-02-28 23:21 - 2015-02-28 23:21 - 00380416 _____ () C:\Users\Thomas\Desktop\1ojl221i.exe
2015-02-28 23:20 - 2015-02-28 23:20 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-02-24 18:33 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-24 18:33 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2015-02-24 18:32 - 2014-12-09 00:12 - 00391526 _____ () C:\windows\system32\ApnDatabase.xml
2015-02-19 18:20 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-19 18:20 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-16 13:00 - 2015-02-16 13:17 - 00000000 ____D () C:\ProgramData\softthinks
2015-02-16 13:00 - 2014-09-18 20:13 - 00000114 ____H () C:\DBAR_Ver.txt
2015-02-16 12:09 - 2015-02-16 12:09 - 00004028 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003484 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2015-02-16 12:09 - 2015-02-16 12:09 - 00003216 _____ () C:\windows\System32\Tasks\SystemToolsDailyTest
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-16 12:09 - 2015-02-16 12:09 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-16 12:06 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-16 12:06 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-02-16 12:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-16 12:06 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-16 12:06 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-16 12:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-16 12:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-16 12:06 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-02-16 12:06 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-16 12:06 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-16 12:06 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2015-02-16 12:06 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2015-02-16 12:06 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-16 12:06 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-16 12:06 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-16 12:06 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-16 12:06 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-16 12:06 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-16 12:06 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-16 12:06 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-16 12:06 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-16 12:05 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-16 12:05 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-16 12:05 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2015-02-16 12:05 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2015-02-16 12:05 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-16 12:05 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-16 12:05 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-02-16 12:05 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-16 12:05 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-16 12:05 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-16 12:05 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-16 12:05 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-16 12:05 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-16 12:05 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-02-16 12:05 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-02-16 12:05 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2015-02-16 12:05 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2015-02-16 12:05 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2015-02-16 12:05 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2015-02-16 12:03 - 2015-02-16 12:56 - 00000000 ____D () C:\ProgramData\HP
2015-02-14 14:32 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\windows\system32\sppobjs.dll
2015-02-14 14:31 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-14 14:31 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-14 14:31 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-04 09:30 - 2015-02-16 12:48 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-01 20:16 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2015-02-01 20:16 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2015-02-01 20:16 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-01 20:16 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-01 20:16 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-02 08:42 - 2013-02-14 06:23 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-02 08:40 - 2014-01-02 21:34 - 00000000 ___DO () C:\Users\Thomas\SkyDrive
2015-03-02 08:40 - 2013-08-22 15:46 - 00301238 _____ () C:\windows\setupact.log
2015-03-02 08:40 - 2013-08-22 15:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-03-02 08:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\windows\system32\config\BBI
2015-03-02 08:16 - 2014-01-02 21:29 - 01555160 _____ () C:\windows\WindowsUpdate.log
2015-03-02 08:04 - 2013-04-09 19:41 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1150857881-869180809-2020834858-1001
2015-03-02 08:00 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sru
2015-03-02 07:59 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\AppReadiness
2015-03-02 07:59 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2015-03-02 07:44 - 2014-01-26 16:27 - 00003926 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{81BFCCB7-35B1-4144-92E6-6B85C9E70A66}
2015-03-01 23:50 - 2013-11-13 23:18 - 00382360 _____ () C:\windows\PFRO.log
2015-03-01 10:21 - 2014-01-02 21:16 - 00000000 ____D () C:\Users\Thomas
2015-03-01 09:34 - 2013-11-14 08:27 - 01780340 _____ () C:\windows\system32\PerfStringBackup.INI
2015-03-01 09:34 - 2013-11-14 08:11 - 00766620 _____ () C:\windows\system32\perfh007.dat
2015-03-01 09:34 - 2013-11-14 08:11 - 00159902 _____ () C:\windows\system32\perfc007.dat
2015-02-28 23:19 - 2014-01-26 16:26 - 00000000 ____D () C:\Users\Thomas\AppData\Local\DoNotTrackPlus
2015-02-28 23:17 - 2014-12-10 17:38 - 00001373 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
2015-02-28 23:17 - 2014-12-10 17:36 - 00001348 _____ () C:\Users\Thomas\Desktop\Chrome.lnk
2015-02-16 13:00 - 2013-04-10 03:49 - 00000000 ____D () C:\Users\Thomas\AppData\Local\softthinks
2015-02-16 12:49 - 2013-08-22 15:44 - 00371656 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-16 12:48 - 2014-09-08 13:05 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-16 12:46 - 2013-08-18 18:25 - 00000000 ____D () C:\windows\system32\MRT
2015-02-16 12:45 - 2013-04-14 11:15 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-16 12:11 - 2013-12-01 18:33 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Vorlage
2015-02-16 12:09 - 2013-04-09 19:32 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Packages
2015-02-16 12:09 - 2013-02-14 06:25 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-16 12:09 - 2013-02-14 06:15 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-16 12:09 - 2013-02-14 06:09 - 00000000 ____D () C:\Program Files\Dell
2015-02-16 12:04 - 2013-08-22 16:36 - 00262144 _____ () C:\windows\system32\config\BCD-Template
2015-02-08 18:56 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\Recovery
2015-02-04 09:30 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-01 21:05 - 2014-04-27 09:00 - 00000000 ____D () C:\Users\Thomas\Documents\Fahrtenbuch Bökmann 2014
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-RS
2015-02-01 20:04 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\sr-Latn-CS
2015-02-01 15:58 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\LiveKernelReports

==================== Files in the root of some directories =======

2014-09-24 10:03 - 2014-09-24 10:04 - 0006656 _____ () C:\Users\Thomas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-14 06:19 - 2013-02-14 06:20 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-02-14 06:15 - 2013-02-14 06:16 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-02-14 06:16 - 2013-02-14 06:18 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2013-02-14 06:15 - 2013-02-14 06:15 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-02-14 06:18 - 2013-02-14 06:19 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-02 07:58

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-02-2015
Ran by Thomas at 2015-03-02 08:45:31
Running from C:\Users\Thomas\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ZoneAlarm Free Firewall Antivirus (Enabled - Up to date) {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ZoneAlarm Free Firewall Anti-Spyware (Enabled - Up to date) {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
FW: ZoneAlarm Free Firewall Firewall (Enabled) {E6380B7E-D4B2-19F1-083E-56486607704B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
AMD Catalyst Install Manager (HKLM\...\{B9C542F2-31A8-8EC1-B349-28C74D2A865C}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
Chromium Browser (HKU\S-1-5-21-1150857881-869180809-2020834858-1001\...\Chromium) (Version: 41.0.2231.0 - Chrome)
CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.7.5.63 - Dell Inc.)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.16.1 - Dell Inc.)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 16.2.12.17 - Synaptics Incorporated)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3379 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{0728A184-F899-4356-B93D-8228674F0DEB}) (Version: 2.6.1209.0268 - Motorola Solutions, Inc.)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
PowerXpressHybrid (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.15.012 - Dell Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6741 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version:  - eTeks)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.6 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.6.2.0 - Intel)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
ZoneAlarm Antivirus (x32 Version: 11.0.000.057 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (x32 Version: 12.0.104.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 12.0.104.000 - Check Point)
ZoneAlarm Security (x32 Version: 12.0.104.000 - Check Point Software Technologies Ltd.) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

14-02-2015 14:18:55 Windows Update
19-02-2015 18:28:18 Windows Update
01-03-2015 22:45:05 Revo Uninstaller's restore point - Yahoo Community Smartbar Engine

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {17143C45-F1EE-43EA-AFB0-A18161C4CFAF} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {936819C1-9723-4BF5-A882-82059C645D74} - System32\Tasks\Dell\Dell System Registration => C:\Program Files (x86)\System Registration\prodreg.exe [2012-07-09] (Dell, Inc.)
Task: {B8A71C1B-63B8-4F91-862F-5D9A51D63648} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {C146BAAF-E489-4A00-8988-B0E5FBE67613} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {E06E9AD8-62AE-425F-B843-07FA73E0B94D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-16] (Microsoft Corporation)
Task: C:\windows\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (whitelisted) ==============

2013-02-14 06:18 - 2012-04-25 03:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2013-12-21 00:02 - 2013-12-21 00:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-02-14 13:57 - 2012-09-21 01:40 - 04875576 _____ () C:\Program Files\Synaptics\SynTP\DellTouchpad.exe
2012-08-10 15:51 - 2012-08-10 15:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2013-02-14 06:16 - 2012-06-08 04:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 11:34 - 2012-06-08 11:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-12-10 17:36 - 2014-12-01 06:48 - 01409536 _____ () C:\Users\Thomas\AppData\Local\Chrome\Application\41.0.2231.0\libglesv2.dll
2014-12-10 17:36 - 2014-12-01 06:48 - 00223744 _____ () C:\Users\Thomas\AppData\Local\Chrome\Application\41.0.2231.0\libegl.dll
2014-12-10 17:36 - 2014-12-01 06:48 - 09528320 _____ () C:\Users\Thomas\AppData\Local\Chrome\Application\41.0.2231.0\pdf.dll
2015-03-02 08:01 - 2015-03-02 08:01 - 00016384 _____ () C:\windows\assembly\NativeImages_v4.0.30319_32\PSIClient\80a14cd14e9579821dba2282b4349fef\PSIClient.ni.dll
2013-02-14 06:09 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\windows\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade
AlternateDataStreams: C:\Users\Thomas\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1150857881-869180809-2020834858-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Dell\Win LtBlue 1920x1200.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-1150857881-869180809-2020834858-500 - Administrator - Disabled)
Gast (S-1-5-21-1150857881-869180809-2020834858-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1150857881-869180809-2020834858-1003 - Limited - Enabled)
Thomas (S-1-5-21-1150857881-869180809-2020834858-1001 - Administrator - Enabled) => C:\Users\Thomas

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/02/2015 08:44:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350e0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17278, Zeitstempel: 0x53eebf2e
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000606c
ID des fehlerhaften Prozesses: 0xcb8
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Vollständiger Name des fehlerhaften Pakets: CCC.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CCC.exe5

Error: (03/02/2015 08:44:23 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/02/2015 08:42:52 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/02/2015 08:11:51 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "OS (C:)" wurde aufgrund eines Fehlers nicht optimiert: Das Element ist in der Tabelle bereits vorhanden. Alle Einträge in der Tabelle müssen eindeutig sein. (0x89000014)

Error: (03/01/2015 11:56:24 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/01/2015 11:56:22 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/01/2015 11:56:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/01/2015 11:56:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/01/2015 11:56:01 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/01/2015 11:55:57 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.


System errors:
=============
Error: (03/02/2015 08:39:51 AM) (Source: Application Popup) (EventID: 875) (User: )
Description: klif.sys

Error: (03/02/2015 08:24:13 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Superfetch" wurde mit folgendem Fehler beendet: 
%%1062

Error: (03/01/2015 11:52:16 PM) (Source: bowser) (EventID: 8016) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "THOMAS" auf Transport "NetBT_Tcpip_{502DC5DD-69CC-49B5-B041-F7D7F64B9C28}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.

Error: (03/01/2015 11:50:27 PM) (Source: Application Popup) (EventID: 875) (User: )
Description: klif.sys

Error: (03/01/2015 11:08:23 PM) (Source: Application Popup) (EventID: 875) (User: )
Description: klif.sys

Error: (03/01/2015 10:03:59 AM) (Source: Application Popup) (EventID: 875) (User: )
Description: klif.sys

Error: (03/01/2015 10:04:33 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎01.‎03.‎2015 um 09:52:43 unerwartet heruntergefahren.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/01/2015 09:57:54 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SoftThinks Agent Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (03/02/2015 08:44:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe3.5.0.04f8350e0KERNELBASE.dll6.3.9600.1727853eebf2ee0434352000000000000606ccb801d054bc398d2bd0C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\windows\system32\KERNELBASE.dllf1246ad7-c0af-11e4-bea0-6036ddc18148

Error: (03/02/2015 08:44:23 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (03/02/2015 08:42:52 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/02/2015 08:11:51 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: OS (C:)Das Element ist in der Tabelle bereits vorhanden. Alle Einträge in der Tabelle müssen eindeutig sein. (0x89000014)

Error: (03/01/2015 11:56:24 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe

Error: (03/01/2015 11:56:22 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe

Error: (03/01/2015 11:56:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe

Error: (03/01/2015 11:56:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe

Error: (03/01/2015 11:56:01 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe

Error: (03/01/2015 11:55:57 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Thomas\Downloads\esetsmartinstaller_deu.exe


CodeIntegrity Errors:
===================================
  Date: 2013-11-03 16:17:58.893
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:16:55.612
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:16:55.581
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 20:03:44.481
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:57:01.363
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:54:58.245
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:40:03.269
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 19:31:45.638
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 18:47:58.893
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-11-01 18:39:49.989
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3337U CPU @ 1.80GHz
Percentage of memory in use: 20%
Total physical RAM: 8061.27 MB
Available physical RAM: 6379.44 MB
Total Pagefile: 9341.27 MB
Available Pagefile: 7628.14 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:916.28 GB) (Free:863 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: A40BCF23)

Partition: GPT Partition Type.

==================== End Of Log ============================

Gruß PCOldie

Bootsektor · 02.03.2015, 22:07

Hallo,

ist nur Kleinkram

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Program Files (x86)\CheckPoint\Install\CUninstallerZA.exe
C:\Program Files (x86)\CheckPoint\Install\zatb.exe
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

OK
So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber.
Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir.

Defogger brauchst du nocht enablen

Schritt 1

Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren.
Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen.

Schritt 2
Downloade dir bitte delfix auf deinen Desktop.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.
DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.

Falls nach Delfix noch Programme aus unserer Bereinigung vorhanden sein sollten, kannst du diese nun bedenkenlos löschen.

Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems.

Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür

verwende für jede Anwendung und jeden Account ein anderes Passwort
ändere regelmäßig dein Passwort, vor allem bei Onlinebanking oder deinem Emailpostfach ist dieses sehr wichtig
speichere keine Passwörter auf deinem PC, gib diese nicht an dritte weiter
ein sicheres Passwort besteht aus mindestens 8 Zeichen und beinhaltet Groß- und Kleinbuchstaben, Zahlen, und Sonderzeichen
benutze keine Zahlen- oder Buchstabenkombinationen, ( zB 12345678, qwertzui) auch keine Zahlen oder Buchstabenmuster
verwende keine Passwörter die einen Bezug zu dir, deinem Wohnort, Familienmitglied oder Haustier (Geburtsdatum, Postleitzahl, Adresse, Name) haben

Aktualität des Systems
Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java, sofern vorhanden) aktuell sind.

Bitte überprüfe, ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.

Antivirensoftware

Gehe sicher immer eine Antiviren Software installiert zu haben und halte diese unbedingt aktuell.

Zusätzlicher Schutz

MalwareBytes Anti-Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On-Demand Scantool welches viele aktuelle Malware erkennt und auch entfernt.
Aktualisiere das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf einen Banner um diesen zu AdBlockPlus hinzuzufügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Systemleistung
Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu die Datenträgerbereinigung von Windows.
Windows Vista

Klicke unten links auf das Vistasymbol
Gehe auf Programme -> Zubehör -> Systemprogramme -> Datenträgerbereinigung
Wähle nun Dateien von allen Benutzern des Computers aus und bestätige mit OK
Setze den Haken bei den zu löschenden Dateien zusätzlich bei Temporäre Dateien
Bestätige mit OK
Bestätige dass du die Dateien unwiderruflich löschen möchtest

Windows 7

Gehe auf das Windowsstartsymbol
Gebe im Suchfeld Datenträgerrereinigung ein
Setze den Haken zusätzlich bei Temporäre Dateien
Bestätige mit OK

Windows 8

Rechtsklicke in die untere linke Ecke deines Bildschirms
Klicke auf Suchen
Klicke auf Einstellungen
Gebe im Suchfeld Datenträgerbereinigung ein
Klicke in den Einstellungen auf der linken Seite nun auf Speicherplatz durch Löschen nicht erforderlicher Dateien freigeben
Setze den Haken zusätzlich bei Temporäre Dateien
Bestätige mit OK
Bestätige dass du die Dateien unwiderruflich löschen möchtest

Halte dich fern von jeglichen Registry Cleanern.
Diese schaden deinem System mehr als dass sie es schneller machen.

Verhaltensregeln zum sichereren Surfen

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Achte besonders bei der Installation von Programmen darauf, ob sich weitere Software mitinstallieren möchte, wähle wo immer es geht die benutzerdefinierte Installation und wähle alles ab, was nichts mit dem Programm zu tun hat, welches du dir installieren möchtest.

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind.

Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun.

Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun.

PCOldie · 03.03.2015, 19:48

Hallo Sandra,

hier schon mal der erste Teil vom Schritt 1, FRST Fix

die anderen führe ich danach aus.

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-02-2015
Ran by Thomas at 2015-03-02 22:44:33 Run:3
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available profiles: Thomas)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files (x86)\CheckPoint\Install\CUninstallerZA.exe
C:\Program Files (x86)\CheckPoint\Install\zatb.exe
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll
         
*****************

C:\Program Files (x86)\CheckPoint\Install\CUninstallerZA.exe => Moved successfully.
C:\Program Files (x86)\CheckPoint\Install\zatb.exe => Moved successfully.
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll => Moved successfully.

==== End of Fixlog 22:44:34 ====

Hallo Sandra,

alle Schritte durchgeführt, sieht gut aus

Habe noch Zonealarm deinstalliert und den Avira hinzugefügt.

Nach einem Vollscan zeigt auch der Virenscanner keine weiteren Auffälligkeiten

.

Vielen Dank für Deine schnelle Hilfe.

Gruß PCOldie

Bootsektor · 03.03.2015, 22:53

Hallo,

bitte, gern geschehen

03.03.2015, 22:53	#10
Bootsektor Ruhe in Frieden † 2019	Windows 8.1 Malware B findet viele Enträge, Rechner langsam, Maus wechselt ständig in Sanduhr Hallo, bitte, gern geschehen __________________ Grüße stolzes Mitglied von UNITE Du hast Lob oder Verbesserungsvorschläge? Du findest unsere Arbeit gut und möchtest uns finanziell unterstützen? -> Spende

Windows 8.1 Malware B findet viele Enträge, Rechner langsam, Maus wechselt ständig in Sanduhr

Log-Analyse und Auswertung: Windows 8.1 Malware B findet viele Enträge, Rechner langsam, Maus wechselt ständig in Sanduhr