Winzipper und delta homes

Scree · 28.05.2015, 16:41

Hi,
auf dem PC meiner Freundin war heute spontan die Startseite in Firefox verstellt auf delta-homes.com. Ein Blick in die installieren Programme zeigte, dass sich heute eine Software namens Winzipper installiert hat, die laut internet wohl damit in Verbindung steht. Nur wurde heute an dem PC nichts installiert, daher frage ich mich wie sowas kommen kann und wie man das wieder los wird.
Anbei die üblichen scans:
defogger_disable.log

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:07 on 28/05/2015 (Chris)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-

FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01
Ran by Chris (administrator) on TOWER-POWER on 28-05-2015 17:09:14
Running from C:\Users\Chris\Desktop
Loaded Profiles: Chris (Available Profiles: Chris)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
() C:\Gaming Mouse\Gaming Mouse.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2015-01-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Gaming Mouse] => C:\Gaming Mouse\Gaming Mouse.exe [1306624 2009-09-30] ()
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888896 2015-03-24] (Valve Corporation)
Startup: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-01-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:64146;https=127.0.0.1:64146
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421333276&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421333276&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2561094446-920685720-2640435214-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2561094446-920685720-2640435214-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-17] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-17] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 213.211.192.34 8.8.8.8
Tcpip\..\Interfaces\{2D5FC48A-55F6-4052-ABDF-159A06A20D32}: [NameServer] 8.8.8.8,8.8.4.4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499

FireFox:
========
FF ProfilePath: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
FF NetworkProxy: "ftp", "119.110.73.130"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "119.110.73.130"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "119.110.73.130"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "119.110.73.130"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-16] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-16] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF SearchPlugin: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\searchplugins\delta-homes.xml [2015-05-28]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystartsearch.xml [2015-01-15]
FF Extension: QuickSearch - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\quick_searchff@gmail.com [2015-05-28]
FF Extension: Search Enginer - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\sweetsearch@gmail.com [2015-05-28]
FF Extension: Firebug - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\firebug@software.joehewitt.com.xpi [2015-03-05]
FF Extension: Stealthy - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\stealthyextension@gmail.com.xpi [2015-01-17]
FF Extension: Video DownloadHelper - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-26]
FF Extension: Adblock Edge - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-01-13]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\fftoolbar2014@etech.com
FF HKLM-x32\...\Firefox\Extensions: [quick_searchff@gmail.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\quick_searchff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\sweetsearch@gmail.com
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2015-01-17] (Realtek Semiconductor)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [315392 2015-05-20] (SysTool PasSame LIMITED) [File not signed] <==== ATTENTION
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [426128 2015-05-28] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [656664 2014-08-19] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2014-11-21] (Advanced Micro Devices)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-06-21] (Advanced Micro Devices)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-15] (Disc Soft Ltd)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [457496 2015-01-14] (Intel Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 17:09 - 2015-05-28 17:09 - 00016860 _____ () C:\Users\Chris\Desktop\FRST.txt
2015-05-28 17:08 - 2015-05-28 17:09 - 00000000 ____D () C:\FRST
2015-05-28 17:07 - 2015-05-28 17:07 - 00000542 _____ () C:\Users\Chris\Desktop\defogger_disable.log
2015-05-28 17:07 - 2015-05-28 17:07 - 00000168 _____ () C:\Users\Chris\defogger_reenable
2015-05-28 17:06 - 2015-05-28 17:04 - 02108928 _____ (Farbar) C:\Users\Chris\Desktop\FRST64.exe
2015-05-28 17:06 - 2015-05-28 17:04 - 00380416 _____ () C:\Users\Chris\Desktop\q3c7d44r.exe
2015-05-28 17:06 - 2015-05-28 17:03 - 00050477 _____ () C:\Users\Chris\Desktop\Defogger.exe
2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\WinZipper
2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\WinZipper
2015-05-21 19:40 - 2015-05-21 19:40 - 00000000 ____D () C:\Users\Chris\Documents\eBooks
2015-05-21 19:39 - 2015-05-21 19:39 - 00000000 ____D () C:\Users\Chris\Documents\Neuer Ordner
2015-05-21 19:37 - 2015-05-21 19:38 - 70217728 _____ () C:\Users\Chris\Downloads\calibre-64bit-2.28.0.msi
2015-05-20 23:14 - 2015-05-20 23:36 - 154430818 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal Akt 22 Erwartungen - Nemesis - - Niconic.mp4
2015-05-20 23:13 - 2015-05-20 23:18 - 74414621 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal 21.mp4
2015-05-18 19:15 - 2015-05-18 19:15 - 00747216 _____ (Installer generic ) C:\Users\Chris\Downloads\miranda-im-v0.10.32-unicode.exe
2015-05-16 14:05 - 2015-05-16 14:05 - 00279816 _____ () C:\Windows\Minidump\051615-4156-01.dmp
2015-05-16 13:43 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-14 13:21 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:21 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:19 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-14 13:19 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-14 13:19 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-14 13:19 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-14 13:19 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-05-14 13:19 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-14 13:19 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-14 13:19 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-14 13:19 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-14 13:17 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-14 13:17 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-14 13:17 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-14 13:17 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-14 13:17 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-14 13:17 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-14 13:17 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-14 13:17 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-14 13:17 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-14 13:17 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-14 13:17 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-14 13:17 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-14 13:17 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-05-14 13:17 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-14 13:17 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-14 13:17 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-14 13:17 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-14 13:17 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-14 13:17 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-14 13:17 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-14 13:17 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-14 13:17 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-14 13:17 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-14 13:17 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-14 13:17 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2015-05-14 13:17 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2015-05-14 13:17 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2015-05-14 13:17 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2015-05-14 13:17 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-14 13:17 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-14 13:17 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-14 13:17 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-14 13:17 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-14 13:17 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:29 - 00410017 _____ () C:\Windows\system32\ApnDatabase.xml
2015-05-14 13:17 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-14 13:17 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-14 13:17 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-14 13:17 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-14 13:17 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-14 13:17 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-14 13:17 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-05 18:27 - 2015-05-05 18:27 - 00014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel
2015-05-04 16:19 - 2015-05-04 16:19 - 00001310 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mcedit2.lnk
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Python-Eggs
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Program Files\mcedit2-win64-2.0.0alpha-232
2015-05-04 15:22 - 2015-05-04 15:23 - 29551850 _____ (Igor Pavlov) C:\Users\Chris\Downloads\mcedit2-win64-2.0.0alpha-232.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 17:07 - 2015-01-13 22:00 - 00000000 ____D () C:\Users\Chris
2015-05-28 17:07 - 2014-09-24 08:16 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-28 17:07 - 2014-09-24 07:43 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2015-05-28 17:07 - 2014-09-24 07:43 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2015-05-28 17:05 - 2013-08-22 16:46 - 00702669 _____ () C:\Windows\setupact.log
2015-05-28 17:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-28 16:49 - 2015-01-13 22:00 - 01917835 _____ () C:\Windows\WindowsUpdate.log
2015-05-28 16:44 - 2015-01-13 22:19 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2561094446-920685720-2640435214-1001
2015-05-28 16:39 - 2015-01-13 19:18 - 00000000 ___RD () C:\Users\Chris\Dropbox
2015-05-28 16:11 - 2015-02-09 14:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-28 15:44 - 2015-04-02 15:11 - 00000000 ____D () C:\Users\Chris\AppData\Local\CrashDumps
2015-05-28 15:44 - 2015-01-15 16:47 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-05-28 15:44 - 2015-01-13 22:00 - 00001764 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-28 15:44 - 2015-01-13 17:28 - 00001485 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-28 14:43 - 2015-01-13 19:14 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Dropbox
2015-05-28 14:43 - 2015-01-13 18:39 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Raptr
2015-05-28 14:42 - 2015-01-16 19:56 - 00000000 ____D () C:\Users\Chris\OneDrive
2015-05-28 14:42 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-28 00:11 - 2015-01-13 16:51 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2015-05-28 00:11 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-26 17:27 - 2015-04-27 14:42 - 00000000 ____D () C:\Users\Chris\Desktop\Ordner
2015-05-26 17:25 - 2015-01-13 19:51 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Guild Wars 2
2015-05-21 19:47 - 2015-01-29 17:14 - 00000000 ____D () C:\Users\Chris\Documents\Calibre-Bibliothek
2015-05-21 19:40 - 2015-01-15 16:18 - 00000000 ____D () C:\Users\Chris\Sonstiges
2015-05-21 17:50 - 2015-01-18 21:27 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\vlc
2015-05-21 16:02 - 2015-01-13 18:52 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-20 22:03 - 2015-01-26 15:12 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\TS3Client
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 17:40 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-19 15:40 - 2015-01-13 18:39 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-05-19 15:38 - 2014-09-23 23:06 - 00048806 _____ () C:\Windows\PFRO.log
2015-05-17 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2015-05-17 12:48 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-17 11:26 - 2015-01-17 22:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 14:05 - 2015-02-08 04:32 - 504073285 _____ () C:\Windows\MEMORY.DMP
2015-05-16 14:05 - 2015-02-08 04:32 - 00000000 ____D () C:\Windows\Minidump
2015-05-16 11:10 - 2015-01-14 13:41 - 00000000 ____D () C:\Users\Chris\AppData\Local\Adobe
2015-05-16 11:09 - 2015-02-09 14:20 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-15 18:18 - 2013-08-22 16:44 - 00410048 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 23:42 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-05-14 23:42 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 13:22 - 2015-01-15 17:37 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-14 13:21 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 17:27 - 2015-01-13 17:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 17:26 - 2015-01-13 17:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-09 13:03 - 2015-01-13 19:16 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 18:48 - 2015-01-25 13:57 - 00000000 ____D () C:\Users\Chris\Documents\Guild Wars 2
2015-05-05 19:59 - 2014-09-24 09:43 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-05 19:59 - 2014-09-24 09:43 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 18:43 - 2015-01-14 00:05 - 00000000 ____D () C:\Users\Chris\.gimp-2.8
2015-05-05 18:27 - 2015-01-16 02:25 - 00000000 ____D () C:\Users\Chris\AppData\Local\gtk-2.0
2015-04-29 18:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF

==================== Files in the root of some directories =======

2015-01-25 18:12 - 2015-01-25 18:12 - 0001248 _____ () C:\Users\Chris\AppData\Roaming\MIETPOSV
2015-01-25 18:12 - 2015-01-25 18:12 - 0002086 _____ () C:\Users\Chris\AppData\Roaming\SUS
2015-01-20 23:54 - 2015-01-20 23:54 - 0003584 _____ () C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-05-05 18:27 - 2015-05-05 18:27 - 0014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel

Some files in TEMP:
====================
C:\Users\Chris\AppData\Local\Temp\1596.exe
C:\Users\Chris\AppData\Local\Temp\2024.exe
C:\Users\Chris\AppData\Local\Temp\2596.exe
C:\Users\Chris\AppData\Local\Temp\2908.exe
C:\Users\Chris\AppData\Local\Temp\3444.exe
C:\Users\Chris\AppData\Local\Temp\3668.exe
C:\Users\Chris\AppData\Local\Temp\3916.exe
C:\Users\Chris\AppData\Local\Temp\400.exe
C:\Users\Chris\AppData\Local\Temp\636.exe
C:\Users\Chris\AppData\Local\Temp\908.exe
C:\Users\Chris\AppData\Local\Temp\amd-catalyst-omega-14.12-without-dotnet45-win8.1-64bit.exe
C:\Users\Chris\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\Chris\AppData\Local\Temp\bitool.dll
C:\Users\Chris\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpg578xh.dll
C:\Users\Chris\AppData\Local\Temp\Gw2.exe
C:\Users\Chris\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Chris\AppData\Local\Temp\npp.6.7.4.Installer.exe
C:\Users\Chris\AppData\Local\Temp\ose00000.exe
C:\Users\Chris\AppData\Local\Temp\raptrpatch.exe
C:\Users\Chris\AppData\Local\Temp\raptr_stub.exe
C:\Users\Chris\AppData\Local\Temp\smt_mystartsearch.exe
C:\Users\Chris\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-27 19:15

==================== End of log ============================

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01
Ran by Chris at 2015-05-28 17:09:29
Running from C:\Users\Chris\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2561094446-920685720-2640435214-500 - Administrator - Disabled)
Chris (S-1-5-21-2561094446-920685720-2640435214-1001 - Administrator - Enabled) => C:\Users\Chris
Gast (S-1-5-21-2561094446-920685720-2640435214-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Alice: Madness Returns (HKLM-x32\...\Steam App 19680) (Version:  - Spicy Horse Games)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Brothers - A Tale of Two Sons (HKLM-x32\...\Steam App 225080) (Version:  - Starbreeze Studios AB)
calibre 64bit (HKLM\...\{07AAC4EC-6402-4375-AA46-D7FE1390FFBB}) (Version: 2.23.0 - Kovid Goyal)
Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dropbox (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse)
Gaming Mouse (HKLM-x32\...\Gaming Mouse 3) (Version:  - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GUILD WARS (HKLM-x32\...\Guild Wars) (Version:  - )
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Haskell Platform 2014.2.0.0 (HKLM\...\HaskellPlatform-2014.2.0.0) (Version:  - Haskell.org)
Haunt the House: Terrortown (HKLM-x32\...\Steam App 270630) (Version:  - SFB Games)
Inkscape 0.48.5 (HKLM-x32\...\Inkscape) (Version: 0.48.5 - )
Intel(R) Network Connections 19.0.27.0 (HKLM\...\PROSetDX) (Version: 19.0.27.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Last Dream (HKLM-x32\...\Steam App 266230) (Version:  - White Giant RPG Studios)
LEGO Lord of the Rings (HKLM-x32\...\Steam App 214510) (Version:  - Traveller's Tales)
LIMBO (HKLM-x32\...\Steam App 48000) (Version:  - Playdead)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Miranda IM (HKLM-x32\...\Miranda IM) (Version: 0.10.27 - Miranda IM Project)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
MyPaint 1.0.0 (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\MyPaint) (Version: 1.0.0 - Martin Renold & MyPaint Development Team)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team)
Oblivion (HKLM-x32\...\{C66BF9FD-D367-4E13-8EB8-385FFEA20DB3}) (Version: 1.2.0416 - Bethesda Softworks)
Portal 2 (HKLM-x32\...\Steam App 620) (Version:  - Valve)
Raptr (HKLM-x32\...\Raptr) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Scribblenauts Unlimited (HKLM-x32\...\Steam App 218680) (Version:  - 5th Cell Media)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SimCity 4 Deluxe (HKLM-x32\...\Steam App 24780) (Version:  - EA - Maxis)
Space Engineers (HKLM-x32\...\Steam App 244850) (Version:  - Keen Software House)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Trine (HKLM-x32\...\Steam App 35700) (Version:  - Frozenbyte)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.5-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.98 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
Year Walk (HKLM-x32\...\Steam App 269050) (Version:  - Simogo)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

13-05-2015 17:25:18 Windows Update
20-05-2015 17:39:40 Windows Update
28-05-2015 15:30:53 Geplanter Prüfpunkt

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {3B31EEB1-F47B-417C-9237-9BE14E6A860F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {44FC21B8-FDD7-46F8-89B5-F3FDDCDB3346} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {64C4FEA2-33D5-4C1C-A0C2-43402B8BA2E4} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {AB51F3E1-B437-4015-ABBF-2F8EA2BF25DE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {FC4A3A12-0FA7-4A91-B1BC-E23DE771F816} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-16] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-01-15 23:23 - 2014-08-19 21:12 - 01356568 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2009-09-30 03:05 - 2009-09-30 03:05 - 01306624 _____ () C:\Gaming Mouse\Gaming Mouse.exe
2010-11-23 00:56 - 2010-11-23 00:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd
2014-08-14 02:37 - 2014-08-14 02:37 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll
2013-11-21 02:05 - 2013-11-21 02:05 - 00256000 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd
2015-05-15 04:21 - 2015-05-15 04:21 - 02540288 _____ () C:\Program Files (x86)\Raptr\ltc_host_ex.DLL
2014-08-14 02:37 - 2014-08-14 02:37 - 00027667 _____ () C:\Program Files (x86)\Raptr\plugins\audio_output\libdirectsound_plugin.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 00031251 _____ () C:\Program Files (x86)\Raptr\plugins\audio_output\libwaveout_plugin.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 00066579 _____ () C:\Program Files (x86)\Raptr\plugins\video_output\libdirectdraw_plugin.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd
2014-06-18 02:56 - 2014-06-18 02:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll
2010-11-23 01:06 - 2010-11-23 01:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll
2015-05-28 15:45 - 2015-05-28 05:12 - 00612496 _____ () C:\Program Files (x86)\WinZipper\sqlite3.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Chris\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Chris\Desktop\Einspruch.MP3:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Chris\Pictures\5bqde - Imgur.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "BCSSync"
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "Steam"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [TCP Query User{322D338F-3F69-4D19-91B2-98AD8D2F66E6}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [UDP Query User{7467FFC5-13ED-4061-A2D7-80E229E2ECE8}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [{CD5BD729-1D8B-40A5-9C8D-8BBBE80B0053}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{902F1FCF-C905-4954-A04A-18DA64E0C216}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E9247673-E34E-418E-AFFA-F79E1011444F}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{3799BDDA-B04C-440A-8D24-9B930BF777A2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{877154DD-DEFC-4E7B-B449-F720EEDEDDF0}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{154A3DDE-D904-46AC-BAB1-D61A0F064308}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E2049D11-C7FA-4745-8F15-51F4D07F087C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{6893A4BC-E269-4D4B-9D90-9F896FE19801}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{379F17D2-5FB3-4521-95D5-9C567EF33A57}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{4D2E4BD1-B0CA-4E9A-8A42-7340A6EC6572}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{D9928F33-DA6D-4C4A-98A2-6E0B2BAA41C3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe
FirewallRules: [{27F8199A-33E8-402C-9225-54D84E3F73F9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe
FirewallRules: [{816EC679-99B5-4438-BCE9-334A11621A63}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe
FirewallRules: [{96D4B554-FA25-4BD6-9E4C-907C3A9E6439}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe
FirewallRules: [{19294CB7-8E9F-4A51-9F55-B769F7F02EA5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe
FirewallRules: [{2E511C23-453B-4A30-8071-3D145E4FA734}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe
FirewallRules: [{5498C18F-6E50-4F3E-9BC7-F56B8046A129}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe
FirewallRules: [{294DE233-9F93-427D-B6D5-CAC22F7D6491}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe
FirewallRules: [{4E876F61-CD82-43AD-A0EB-5C3C8C00C754}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{B66AA9F3-0B18-4B26-A35C-327305A98854}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{09F0E349-47E1-4D97-BFFD-295E5215BC33}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe
FirewallRules: [{78DAF125-C3DF-4DE4-8B69-C150D18AA57E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe
FirewallRules: [{D712E4A0-3235-48B5-8D8F-3DE2F1B13082}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe
FirewallRules: [{2280B3F1-D7E3-4C66-A3E5-B084980ED531}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe
FirewallRules: [{19FDCE86-5026-4DBB-8CEF-8C6EE0D3E7E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe
FirewallRules: [{46AFD520-3A5F-4572-82D8-2B344310FF89}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe
FirewallRules: [{7BBA4820-6639-4C99-8805-AD6D31B9127E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe
FirewallRules: [{C52420D8-C425-4265-B126-B598AA9B60B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe
FirewallRules: [{88A0629B-21E2-4A36-83DA-E9E70AC76FDE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe
FirewallRules: [{517471F5-35C3-4DD6-A63B-DAB9CD75EF07}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe
FirewallRules: [TCP Query User{AA2BBCE6-E12C-400A-83EF-FF3E7701D621}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{3E78BDD4-25B8-4566-B8B9-18709F4028DD}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{03674CEF-6239-4211-9039-EBB745833368}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{1C75413F-589C-4E66-8633-30CD01442470}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{3F9E6F76-1128-4746-8599-75137446F34E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{3FC52BCC-077F-4E1E-8FA2-9A598D74CC67}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{1DC78FE1-4B23-4E4D-82CE-B75861196C9E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [{62C5B64B-1CC7-4CF1-9D2B-F03C436CC1BC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [TCP Query User{9B614EE6-93D1-48EF-BBC4-0E8CE89FFF69}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{C9E21A59-E878-4E12-881F-11F712B919A4}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{7C5D5258-9C17-4A92-BBF2-84565B7E6366}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe
FirewallRules: [UDP Query User{93FF9520-49E1-4AE4-91D1-AB2390948071}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe
FirewallRules: [TCP Query User{CAE61E69-ECD6-499B-B972-3F17D64BE7F9}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [UDP Query User{C1E17F90-50BF-455B-85E4-5AA8AEFDD4B1}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [{39CAB1CE-111D-4EEB-9922-D286346B5B54}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE91AB11-0C2A-4865-99D5-9DB98C210BD3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BEDF15BF-34AE-4C4B-899A-0C114093F18F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{6534B34D-8D9D-4FD5-8243-D850B1301A6A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{0014F327-77C4-410F-B503-C0EE1A98128D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{F5E10FBA-9FFE-40A6-9748-4E15BAA0B235}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [TCP Query User{78EBCDE1-06B4-49A3-9CE4-460A1C9EBCE1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{312E7875-7410-40E2-A996-5892C596D2D1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{43FF6593-4E26-42DA-8D41-C265630F4EE6}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{B71851F8-4C88-44A3-9727-1569678021E0}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{04CEAA9D-C4CE-4EAA-94B4-80AD6040B8EF}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{BD96691E-F3FF-4475-9EB0-0EC9D657B660}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

==================== Faulty Device Manager Devices =============

Name: Qualcomm Atheros AR9485-Funknetzwerkadapter
Description: Qualcomm Atheros AR9485-Funknetzwerkadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2
Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0xb94
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2
Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5

Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2
Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0x4ec
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2
Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5

Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x298
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/27/2015 07:15:16 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (05/27/2015 05:30:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x22c
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/26/2015 10:36:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wmplayer.exe, Version 12.0.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 82c

Startzeit: 01d097f3adc3daad

Endzeit: 5

Anwendungspfad: C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Berichts-ID: efcbddb5-03e6-11e5-828f-d0509942e1d9

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


System errors:
=============
Error: (05/28/2015 02:42:40 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/28/2015 02:42:36 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/27/2015 05:30:38 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/27/2015 05:30:34 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/26/2015 02:18:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/26/2015 02:18:01 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/26/2015 01:19:09 AM) (Source: DCOM) (EventID: 10010) (User: TOWER-POWER)
Description: {1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}

Error: (05/25/2015 02:07:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/25/2015 02:07:16 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/24/2015 11:45:16 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037


Microsoft Office:
=========================
Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f2b9401d0994c6ea4f553C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dllac52d525-053f-11e5-8291-d0509942e1d9

Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f24ec01d0994c67446510C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dlla4f53663-053f-11e5-8291-d0509942e1d9

Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert

Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb829801d09943c85890f5C:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe06a27806-0537-11e5-8291-d0509942e1d9

Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/27/2015 07:15:16 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System-reserviertFalscher Parameter. (0x80070057)

Error: (05/27/2015 05:30:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb822c01d0989214db483cC:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe5322cd8b-0485-11e5-8290-d0509942e1d9

Error: (05/26/2015 10:36:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: wmplayer.exe12.0.9600.1741582c01d097f3adc3daad5C:\Program Files (x86)\Windows Media Player\wmplayer.exeefcbddb5-03e6-11e5-828f-d0509942e1d9


CodeIntegrity Errors:
===================================
  Date: 2015-05-28 15:26:09.740
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-27 19:15:22.546
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-26 14:45:18.011
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-25 14:17:25.800
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-24 13:54:52.200
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-23 15:26:44.317
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-22 14:44:37.500
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-20 10:40:37.550
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-19 18:24:36.091
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-18 18:25:52.835
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4460 CPU @ 3.20GHz
Percentage of memory in use: 18%
Total physical RAM: 8127.11 MB
Available physical RAM: 6641.2 MB
Total Pagefile: 16319.11 MB
Available Pagefile: 14286.29 MB
Total Virtual: 131072 MB
Available Virtual: 131071.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.13 GB) (Free:86.3 GB) NTFS
Drive e: (USB-STICK) (Removable) (Total:0.95 GB) (Free:0.94 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 37832B8A)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 972 MB) (Disk ID: 000DAD2F)
Partition 1: (Active) - (Size=972 MB) - (Type=0B)

==================== End of log ============================

GMER.txt

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-28 17:20:04
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002a Crucial_CT256MX100SSD1 rev.MU01 238,47GB
Running: q3c7d44r.exe; Driver: C:\Users\Chris\AppData\Local\Temp\kglyaaow.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                                                                                                fffff960001bb900 15 bytes [00, 57, F4, 01, 40, 8F, 6E, ...]
.text    C:\Windows\System32\win32k.sys!W32pServiceTable + 16                                                                                                                                                                           fffff960001bb910 11 bytes [00, 41, FC, FF, 00, 79, C7, ...]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [572:3164]                                                                                                                                                                                       fffff960008b22d0
---- Processes - GMER 2.1 ----

Process  C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [2840] (Windows SysTool  Svr/SysTool PasSame LIMITED)(2015-01-15 14:47:57)  00000000000d0000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}\Connection@Name                                                                                    isatap.{2D5FC48A-55F6-4052-ABDF-159A06A20D32}
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                                                                                                              -405932739
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@InterfaceName                                                                                                         isatap.{2D5FC48A-55F6-4052-ABDF-159A06A20D32}
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@ReusableType                                                                                                          0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@DefunctTimestamp                                                                                                      0x40 0x0D 0x67 0x55 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                                                                                                                2721
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                                                                                                               813
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WpdUpFltr\Parameters\Wdf@TimeOfLastSqmLog                                                                                                                                               0x95 0x6B 0x0E 0x31 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Run@DAEMON Tools Lite                                                                                                                                                           "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

---- EOF - GMER 2.1 ----

MFG
Scree

deeprybka · 28.05.2015, 16:56

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
Bitte kein Crossposting (posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
Poste die Logfiles direkt in Deinen Thread in Code-Tags.
Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.

Los geht's:

Schritt 1

Bitte deinstalliere folgende Programme:

WinZipper

Versuche es bei Windows 8

mit der Windowstaste + X über

.

Sollte das nicht gehen, lade Dir bitte Revo Uninstaller

hier herunter. Entpacke die zip-Datei auf den Desktop. Anleitung

Starte die Revouninstaller.exe
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
Klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter.
Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus:

Schritt 2
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3

Download und Anleitung
Starte Malwarebytes' Anti-Malware (MBAM).
Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
Unter Einstellungen/ Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
Gehe zurück zum Armaturenbrett und klicke auf "Jetzt scannen".
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben und poste mir das Log.

Schritt 4

Bitte starte FRST erneut, markiere auch die checkbox

und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Scree · 28.05.2015, 17:37

Hallo,
danke für die schnelle Antwort.
Schritt 1: WinZipper ließ sich problemfrei deinstallieren
Schritt 2: AdwCleaner[S0].txt

Code:

ATTFilter

# AdwCleaner v4.205 - Bericht erstellt 28/05/2015 um 18:05:49
# Aktualisiert 21/05/2015 von Xplode
# Datenbank : 2015-05-21.2 [Lokal]
# Betriebssystem : Windows 8.1 Pro  (x64)
# Benutzername : Chris - TOWER-POWER
# Gestarted von : C:\Users\Chris\Desktop\AdwCleaner_4.205.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : WindowsMangerProtect

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\ShopperPro
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\ProgramData\IHProtectUpDate
Ordner Gelöscht : C:\Program Files (x86)\WinZipper
Ordner Gelöscht : C:\Program Files\shopperz
Ordner Gelöscht : C:\Users\Chris\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Chris\AppData\Local\BrowserHelper
Ordner Gelöscht : C:\Users\Chris\AppData\Local\03000200-1424777340-0500-0006-000700080009
Ordner Gelöscht : C:\Users\Chris\AppData\Roaming\mystartsearch
Ordner Gelöscht : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\sweetsearch@gmail.com
Ordner Gelöscht : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\quick_searchff@gmail.com
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Chris\AppData\Roaming\MIETPOSV
Datei Gelöscht : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\searchplugins\delta-homes.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [fftoolbar2014@etech.com]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [sweetsearch@gmail.com]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_searchff@gmail.com]
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKCU\Software\Mozilla\Extends
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\delta-homesSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\hdcode
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
Schlüssel Gelöscht : HKLM\SOFTWARE\SupTab
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\V9
Schlüssel Gelöscht : HKLM\SOFTWARE\winzipersvc
Schlüssel Gelöscht : HKLM\SOFTWARE\mystartsearchSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\IHProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\FFPluginHp
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:64146;hxxps=127.0.0.1:64146
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v38.0.1 (x86 de)

[r79ey395.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[r79ey395.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[r79ey395.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

*************************

AdwCleaner[R0].txt - [5419 Bytes] - [28/05/2015 18:04:29]
AdwCleaner[S0].txt - [4188 Bytes] - [28/05/2015 18:05:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4247  Bytes] ##########

Schritt 3: mbamlog

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 28.05.2015
Suchlauf-Zeit: 18:10:28
Logdatei: mbablog.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.03.09.05
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Chris

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 347733
Verstrichene Zeit: 5 Min, 40 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 1
PUP.Optional.Qone8, HKU\S-1-5-21-2561094446-920685720-2640435214-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [b4c589ba2e5ce155643aa274b35229d7], 

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 8
PUP.Optional.Delta.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[86f3f64d850561d5762dfae8da2b7888]
PUP.Optional.Delta.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[433661e2860425115445a73b08fdaf51]
PUP.Optional.Delta.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[b8c13d06b8d256e01885776bc93c956b]
PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[2950073c048684b26d36a53d12f34ab6]
PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[ceab8bb8d1b9a195afea756d9a6bea16]
PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[f9802e15eaa086b0415c459d0ff6f50b]
PUP.Optional.Delta.A, HKU\S-1-5-21-2561094446-920685720-2640435214-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[58211330bbcf79bd9a0409d9cb3a3fc1]
PUP.Optional.Delta.A, HKU\S-1-5-21-2561094446-920685720-2640435214-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499, Gut: (www.google.com), Schlecht: (hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499),Ersetzt,[4e2b9aa9b5d56fc75f3bb72b719438c8]

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 12
PUP.Optional.Somoto, C:\Users\Chris\AppData\Local\Temp\bitool.dll, In Quarantäne, [f8812e15bcce49ed8a2cbf1831d14ab6], 
PUP.Optional.MyStartSearch.A, C:\Users\Chris\AppData\Local\Temp\smt_mystartsearch.exe, In Quarantäne, [c1b883c051391a1c26296eac3cca6b95], 
PUP.Optional.Somoto, C:\Users\Chris\AppData\Local\Temp\nsfA4F2.tmp, In Quarantäne, [3346162d1872e3538ff9e55f51b43cc4], 
PUP.Optional.Wajam.A, C:\Users\Chris\AppData\Local\Temp\9808.tmp, In Quarantäne, [671261e2ef9bea4cae82541190706997], 
PUP.Optional.SupTab.A, C:\Users\Chris\AppData\Local\Temp\~dl9827\~dljyb\tmp\STab_Down.exe, In Quarantäne, [d3a6dd66e7a3191dd1bbd194f30da65a], 
PUP.Optional.ELEX, C:\Users\Chris\AppData\Local\Temp\~dl9827\~dljyb\tmp\STab_v4.0.exe, In Quarantäne, [5d1c96ad5c2e5adc19f8f33c37cbc838], 
PUP.Optional.WindowsProtectManger.A, C:\Users\Chris\AppData\Local\Temp\~dl9827\~dljyb\tmp\wpm_v20.0.0.1714.exe, In Quarantäne, [d0a98eb5d4b680b6854d78ee2fd1fc04], 
PUP.Optional.InstallCore.A, C:\Users\Chris\Downloads\miranda-im-v0.10.32-unicode.exe, In Quarantäne, [ef8aef5429615dd90bd0d93d738f08f8], 
PUP.Optional.ABEngine.A, C:\Users\Chris\AppData\Local\Temp\abengine.log, In Quarantäne, [403986bdbeccf64062dd456816ed25db], 
PUP.Optional.ABEngine.A, C:\Windows\Temp\abengine.log, In Quarantäne, [ea8f50f37713ef47dc63d1dc3ec58b75], 
PUP.Optional.Delta.A, C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499");), Ersetzt,[4d2cc57e8dfda492d7a1d846fe08629e]
PUP.Optional.MyStartSearch.A, C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\search.json, Gut: (), Schlecht: (mystartsearch), Ersetzt,[97e20142cbbf84b216787c9f25e17e82]

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Hier bin ich über die Datei C:\Users\Chris\Downloads\miranda-im-v0.10.32-unicode.exe gestolpert. Die sollte ja eigentlich nicht gefährlich sein, hab sie trotzdem mit in Quarantäne verschoben.

Schritt 4:
FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01
Ran by Chris (administrator) on TOWER-POWER on 28-05-2015 18:27:29
Running from C:\Users\Chris\Desktop
Loaded Profiles: Chris (Available Profiles: Chris)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Dropbox, Inc.) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
() C:\Gaming Mouse\Gaming Mouse.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2015-01-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Gaming Mouse] => C:\Gaming Mouse\Gaming Mouse.exe [1306624 2009-09-30] ()
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888896 2015-03-24] (Valve Corporation)
Startup: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-01-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-17] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-17] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 213.211.192.34 8.8.8.8
Tcpip\..\Interfaces\{2D5FC48A-55F6-4052-ABDF-159A06A20D32}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF NetworkProxy: "ftp", "119.110.73.130"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "119.110.73.130"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "119.110.73.130"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "119.110.73.130"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-16] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-16] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Extension: Firebug - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\firebug@software.joehewitt.com.xpi [2015-03-05]
FF Extension: Stealthy - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\stealthyextension@gmail.com.xpi [2015-01-17]
FF Extension: Video DownloadHelper - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-26]
FF Extension: Adblock Edge - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-01-13]
FF Extension: No Name - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\quick_searchff@gmail.com [not found]
FF Extension: No Name - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\sweetsearch@gmail.com [not found]
StartMenuInternet: FIREFOX.EXE - firefox.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2015-01-17] (Realtek Semiconductor)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [656664 2014-08-19] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2014-11-21] (Advanced Micro Devices)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-06-21] (Advanced Micro Devices)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-15] (Disc Soft Ltd)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [457496 2015-01-14] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 18:09 - 2015-05-28 18:23 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-28 18:09 - 2015-05-28 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-28 18:09 - 2015-05-28 18:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-28 18:09 - 2015-05-28 18:09 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-28 18:09 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-28 18:09 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-28 18:09 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-28 18:08 - 2015-05-28 18:08 - 00004335 _____ () C:\Users\Chris\Desktop\AdwCleaner[S0].txt
2015-05-28 18:04 - 2015-05-28 18:05 - 00000000 ____D () C:\AdwCleaner
2015-05-28 18:03 - 2015-05-28 18:02 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Chris\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-28 18:03 - 2015-05-28 18:01 - 02222592 _____ () C:\Users\Chris\Desktop\AdwCleaner_4.205.exe
2015-05-28 17:09 - 2015-05-28 18:27 - 00013047 _____ () C:\Users\Chris\Desktop\FRST.txt
2015-05-28 17:08 - 2015-05-28 18:27 - 00000000 ____D () C:\FRST
2015-05-28 17:07 - 2015-05-28 17:07 - 00000168 _____ () C:\Users\Chris\defogger_reenable
2015-05-28 17:06 - 2015-05-28 17:04 - 02108928 _____ (Farbar) C:\Users\Chris\Desktop\FRST64.exe
2015-05-28 17:06 - 2015-05-28 17:04 - 00380416 _____ () C:\Users\Chris\Desktop\q3c7d44r.exe
2015-05-28 17:06 - 2015-05-28 17:03 - 00050477 _____ () C:\Users\Chris\Desktop\Defogger.exe
2015-05-21 19:40 - 2015-05-21 19:40 - 00000000 ____D () C:\Users\Chris\Documents\eBooks
2015-05-21 19:39 - 2015-05-21 19:39 - 00000000 ____D () C:\Users\Chris\Documents\Neuer Ordner
2015-05-21 19:37 - 2015-05-21 19:38 - 70217728 _____ () C:\Users\Chris\Downloads\calibre-64bit-2.28.0.msi
2015-05-20 23:14 - 2015-05-20 23:36 - 154430818 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal Akt 22 Erwartungen - Nemesis - - Niconic.mp4
2015-05-20 23:13 - 2015-05-20 23:18 - 74414621 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal 21.mp4
2015-05-16 14:05 - 2015-05-16 14:05 - 00279816 _____ () C:\Windows\Minidump\051615-4156-01.dmp
2015-05-16 13:43 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-14 13:21 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:21 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:19 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-14 13:19 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-14 13:19 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-14 13:19 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-14 13:19 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-05-14 13:19 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-14 13:19 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-14 13:19 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-14 13:19 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-14 13:17 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-14 13:17 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-14 13:17 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-14 13:17 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-14 13:17 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-14 13:17 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-14 13:17 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-14 13:17 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-14 13:17 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-14 13:17 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-14 13:17 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-14 13:17 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-14 13:17 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-05-14 13:17 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-14 13:17 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-14 13:17 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-14 13:17 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-14 13:17 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-14 13:17 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-14 13:17 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-14 13:17 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-14 13:17 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-14 13:17 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-14 13:17 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-14 13:17 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2015-05-14 13:17 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2015-05-14 13:17 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2015-05-14 13:17 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2015-05-14 13:17 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-14 13:17 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-14 13:17 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-14 13:17 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-14 13:17 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-14 13:17 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:29 - 00410017 _____ () C:\Windows\system32\ApnDatabase.xml
2015-05-14 13:17 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-14 13:17 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-14 13:17 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-14 13:17 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-14 13:17 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-14 13:17 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-14 13:17 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-05 18:27 - 2015-05-05 18:27 - 00014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel
2015-05-04 16:19 - 2015-05-04 16:19 - 00001310 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mcedit2.lnk
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Python-Eggs
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Program Files\mcedit2-win64-2.0.0alpha-232
2015-05-04 15:22 - 2015-05-04 15:23 - 29551850 _____ (Igor Pavlov) C:\Users\Chris\Downloads\mcedit2-win64-2.0.0alpha-232.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 18:26 - 2014-09-24 08:16 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-28 18:26 - 2014-09-24 07:43 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2015-05-28 18:26 - 2014-09-24 07:43 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2015-05-28 18:24 - 2015-01-13 22:00 - 02078160 _____ () C:\Windows\WindowsUpdate.log
2015-05-28 18:22 - 2015-01-16 19:56 - 00000000 ___RD () C:\Users\Chris\OneDrive
2015-05-28 18:22 - 2015-01-13 16:51 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2015-05-28 18:22 - 2014-09-23 23:06 - 00051644 _____ () C:\Windows\PFRO.log
2015-05-28 18:22 - 2013-08-22 16:46 - 00703017 _____ () C:\Windows\setupact.log
2015-05-28 18:22 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-28 18:15 - 2015-01-13 22:19 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2561094446-920685720-2640435214-1001
2015-05-28 18:11 - 2015-02-09 14:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-28 18:07 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-28 18:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-28 17:07 - 2015-01-13 22:00 - 00000000 ____D () C:\Users\Chris
2015-05-28 16:39 - 2015-01-13 19:18 - 00000000 ___RD () C:\Users\Chris\Dropbox
2015-05-28 15:44 - 2015-04-02 15:11 - 00000000 ____D () C:\Users\Chris\AppData\Local\CrashDumps
2015-05-28 15:44 - 2015-01-13 22:00 - 00001764 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-28 15:44 - 2015-01-13 17:28 - 00001485 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-28 14:43 - 2015-01-13 19:14 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Dropbox
2015-05-28 14:43 - 2015-01-13 18:39 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Raptr
2015-05-26 17:27 - 2015-04-27 14:42 - 00000000 ____D () C:\Users\Chris\Desktop\Ordner
2015-05-26 17:25 - 2015-01-13 19:51 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Guild Wars 2
2015-05-21 19:47 - 2015-01-29 17:14 - 00000000 ____D () C:\Users\Chris\Documents\Calibre-Bibliothek
2015-05-21 19:40 - 2015-01-15 16:18 - 00000000 ____D () C:\Users\Chris\Sonstiges
2015-05-21 17:50 - 2015-01-18 21:27 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\vlc
2015-05-21 16:02 - 2015-01-13 18:52 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-20 22:03 - 2015-01-26 15:12 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\TS3Client
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 17:40 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-19 15:40 - 2015-01-13 18:39 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-05-17 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2015-05-17 12:48 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-17 11:26 - 2015-01-17 22:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 14:05 - 2015-02-08 04:32 - 504073285 _____ () C:\Windows\MEMORY.DMP
2015-05-16 14:05 - 2015-02-08 04:32 - 00000000 ____D () C:\Windows\Minidump
2015-05-16 11:10 - 2015-01-14 13:41 - 00000000 ____D () C:\Users\Chris\AppData\Local\Adobe
2015-05-16 11:09 - 2015-02-09 14:20 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-15 18:18 - 2013-08-22 16:44 - 00410048 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 23:42 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-05-14 23:42 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 13:22 - 2015-01-15 17:37 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-14 13:21 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 17:27 - 2015-01-13 17:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 17:26 - 2015-01-13 17:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-09 13:03 - 2015-01-13 19:16 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 18:48 - 2015-01-25 13:57 - 00000000 ____D () C:\Users\Chris\Documents\Guild Wars 2
2015-05-05 19:59 - 2014-09-24 09:43 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-05 19:59 - 2014-09-24 09:43 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 18:43 - 2015-01-14 00:05 - 00000000 ____D () C:\Users\Chris\.gimp-2.8
2015-05-05 18:27 - 2015-01-16 02:25 - 00000000 ____D () C:\Users\Chris\AppData\Local\gtk-2.0
2015-04-29 18:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF

==================== Files in the root of some directories =======

2015-01-25 18:12 - 2015-01-25 18:12 - 0002086 _____ () C:\Users\Chris\AppData\Roaming\SUS
2015-01-20 23:54 - 2015-01-20 23:54 - 0003584 _____ () C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-05-05 18:27 - 2015-05-05 18:27 - 0014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel

Some files in TEMP:
====================
C:\Users\Chris\AppData\Local\Temp\1596.exe
C:\Users\Chris\AppData\Local\Temp\2024.exe
C:\Users\Chris\AppData\Local\Temp\2596.exe
C:\Users\Chris\AppData\Local\Temp\2908.exe
C:\Users\Chris\AppData\Local\Temp\3444.exe
C:\Users\Chris\AppData\Local\Temp\3668.exe
C:\Users\Chris\AppData\Local\Temp\3916.exe
C:\Users\Chris\AppData\Local\Temp\400.exe
C:\Users\Chris\AppData\Local\Temp\636.exe
C:\Users\Chris\AppData\Local\Temp\908.exe
C:\Users\Chris\AppData\Local\Temp\amd-catalyst-omega-14.12-without-dotnet45-win8.1-64bit.exe
C:\Users\Chris\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\Chris\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsi5yaw.dll
C:\Users\Chris\AppData\Local\Temp\Gw2.exe
C:\Users\Chris\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Chris\AppData\Local\Temp\npp.6.7.4.Installer.exe
C:\Users\Chris\AppData\Local\Temp\ose00000.exe
C:\Users\Chris\AppData\Local\Temp\Quarantine.exe
C:\Users\Chris\AppData\Local\Temp\raptrpatch.exe
C:\Users\Chris\AppData\Local\Temp\raptr_stub.exe
C:\Users\Chris\AppData\Local\Temp\sqlite3.dll
C:\Users\Chris\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-27 19:15

==================== End of log ============================

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01
Ran by Chris at 2015-05-28 18:27:43
Running from C:\Users\Chris\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2561094446-920685720-2640435214-500 - Administrator - Disabled)
Chris (S-1-5-21-2561094446-920685720-2640435214-1001 - Administrator - Enabled) => C:\Users\Chris
Gast (S-1-5-21-2561094446-920685720-2640435214-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Alice: Madness Returns (HKLM-x32\...\Steam App 19680) (Version:  - Spicy Horse Games)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Brothers - A Tale of Two Sons (HKLM-x32\...\Steam App 225080) (Version:  - Starbreeze Studios AB)
calibre 64bit (HKLM\...\{07AAC4EC-6402-4375-AA46-D7FE1390FFBB}) (Version: 2.23.0 - Kovid Goyal)
Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dropbox (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse)
Gaming Mouse (HKLM-x32\...\Gaming Mouse 3) (Version:  - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GUILD WARS (HKLM-x32\...\Guild Wars) (Version:  - )
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Haskell Platform 2014.2.0.0 (HKLM\...\HaskellPlatform-2014.2.0.0) (Version:  - Haskell.org)
Haunt the House: Terrortown (HKLM-x32\...\Steam App 270630) (Version:  - SFB Games)
Inkscape 0.48.5 (HKLM-x32\...\Inkscape) (Version: 0.48.5 - )
Intel(R) Network Connections 19.0.27.0 (HKLM\...\PROSetDX) (Version: 19.0.27.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Last Dream (HKLM-x32\...\Steam App 266230) (Version:  - White Giant RPG Studios)
LEGO Lord of the Rings (HKLM-x32\...\Steam App 214510) (Version:  - Traveller's Tales)
LIMBO (HKLM-x32\...\Steam App 48000) (Version:  - Playdead)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Miranda IM (HKLM-x32\...\Miranda IM) (Version: 0.10.27 - Miranda IM Project)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
MyPaint 1.0.0 (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\MyPaint) (Version: 1.0.0 - Martin Renold & MyPaint Development Team)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team)
Oblivion (HKLM-x32\...\{C66BF9FD-D367-4E13-8EB8-385FFEA20DB3}) (Version: 1.2.0416 - Bethesda Softworks)
Portal 2 (HKLM-x32\...\Steam App 620) (Version:  - Valve)
Raptr (HKLM-x32\...\Raptr) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Scribblenauts Unlimited (HKLM-x32\...\Steam App 218680) (Version:  - 5th Cell Media)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SimCity 4 Deluxe (HKLM-x32\...\Steam App 24780) (Version:  - EA - Maxis)
Space Engineers (HKLM-x32\...\Steam App 244850) (Version:  - Keen Software House)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Trine (HKLM-x32\...\Steam App 35700) (Version:  - Frozenbyte)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.5-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
Year Walk (HKLM-x32\...\Steam App 269050) (Version:  - Simogo)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

13-05-2015 17:25:18 Windows Update
20-05-2015 17:39:40 Windows Update
28-05-2015 15:30:53 Geplanter Prüfpunkt

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {3B31EEB1-F47B-417C-9237-9BE14E6A860F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {44FC21B8-FDD7-46F8-89B5-F3FDDCDB3346} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {64C4FEA2-33D5-4C1C-A0C2-43402B8BA2E4} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {AB51F3E1-B437-4015-ABBF-2F8EA2BF25DE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {FC4A3A12-0FA7-4A91-B1BC-E23DE771F816} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-16] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-03-02 16:43 - 2015-03-02 16:43 - 00099288 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2015-01-15 23:23 - 2014-08-19 21:12 - 01356568 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2009-09-30 03:05 - 2009-09-30 03:05 - 01306624 _____ () C:\Gaming Mouse\Gaming Mouse.exe
2015-05-28 18:23 - 2015-05-28 18:23 - 00043008 _____ () c:\users\chris\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsi5yaw.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Chris\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Chris\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Chris\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Chris\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd
2014-08-14 02:37 - 2014-08-14 02:37 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll
2013-11-21 02:05 - 2013-11-21 02:05 - 00256000 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd
2014-06-18 02:56 - 2014-06-18 02:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll
2010-11-23 01:06 - 2010-11-23 01:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Chris\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Chris\Desktop\Einspruch.MP3:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Chris\Pictures\5bqde - Imgur.jpg
DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "BCSSync"
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "Steam"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [TCP Query User{322D338F-3F69-4D19-91B2-98AD8D2F66E6}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [UDP Query User{7467FFC5-13ED-4061-A2D7-80E229E2ECE8}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [{CD5BD729-1D8B-40A5-9C8D-8BBBE80B0053}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{902F1FCF-C905-4954-A04A-18DA64E0C216}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E9247673-E34E-418E-AFFA-F79E1011444F}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{3799BDDA-B04C-440A-8D24-9B930BF777A2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{877154DD-DEFC-4E7B-B449-F720EEDEDDF0}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{154A3DDE-D904-46AC-BAB1-D61A0F064308}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E2049D11-C7FA-4745-8F15-51F4D07F087C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{6893A4BC-E269-4D4B-9D90-9F896FE19801}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{379F17D2-5FB3-4521-95D5-9C567EF33A57}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{4D2E4BD1-B0CA-4E9A-8A42-7340A6EC6572}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{D9928F33-DA6D-4C4A-98A2-6E0B2BAA41C3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe
FirewallRules: [{27F8199A-33E8-402C-9225-54D84E3F73F9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe
FirewallRules: [{816EC679-99B5-4438-BCE9-334A11621A63}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe
FirewallRules: [{96D4B554-FA25-4BD6-9E4C-907C3A9E6439}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe
FirewallRules: [{19294CB7-8E9F-4A51-9F55-B769F7F02EA5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe
FirewallRules: [{2E511C23-453B-4A30-8071-3D145E4FA734}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe
FirewallRules: [{5498C18F-6E50-4F3E-9BC7-F56B8046A129}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe
FirewallRules: [{294DE233-9F93-427D-B6D5-CAC22F7D6491}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe
FirewallRules: [{4E876F61-CD82-43AD-A0EB-5C3C8C00C754}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{B66AA9F3-0B18-4B26-A35C-327305A98854}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{09F0E349-47E1-4D97-BFFD-295E5215BC33}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe
FirewallRules: [{78DAF125-C3DF-4DE4-8B69-C150D18AA57E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe
FirewallRules: [{D712E4A0-3235-48B5-8D8F-3DE2F1B13082}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe
FirewallRules: [{2280B3F1-D7E3-4C66-A3E5-B084980ED531}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe
FirewallRules: [{19FDCE86-5026-4DBB-8CEF-8C6EE0D3E7E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe
FirewallRules: [{46AFD520-3A5F-4572-82D8-2B344310FF89}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe
FirewallRules: [{7BBA4820-6639-4C99-8805-AD6D31B9127E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe
FirewallRules: [{C52420D8-C425-4265-B126-B598AA9B60B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe
FirewallRules: [{88A0629B-21E2-4A36-83DA-E9E70AC76FDE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe
FirewallRules: [{517471F5-35C3-4DD6-A63B-DAB9CD75EF07}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe
FirewallRules: [TCP Query User{AA2BBCE6-E12C-400A-83EF-FF3E7701D621}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{3E78BDD4-25B8-4566-B8B9-18709F4028DD}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{03674CEF-6239-4211-9039-EBB745833368}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{1C75413F-589C-4E66-8633-30CD01442470}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{3F9E6F76-1128-4746-8599-75137446F34E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{3FC52BCC-077F-4E1E-8FA2-9A598D74CC67}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{1DC78FE1-4B23-4E4D-82CE-B75861196C9E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [{62C5B64B-1CC7-4CF1-9D2B-F03C436CC1BC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [TCP Query User{9B614EE6-93D1-48EF-BBC4-0E8CE89FFF69}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{C9E21A59-E878-4E12-881F-11F712B919A4}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{7C5D5258-9C17-4A92-BBF2-84565B7E6366}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe
FirewallRules: [UDP Query User{93FF9520-49E1-4AE4-91D1-AB2390948071}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe
FirewallRules: [TCP Query User{CAE61E69-ECD6-499B-B972-3F17D64BE7F9}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [UDP Query User{C1E17F90-50BF-455B-85E4-5AA8AEFDD4B1}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [{39CAB1CE-111D-4EEB-9922-D286346B5B54}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE91AB11-0C2A-4865-99D5-9DB98C210BD3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BEDF15BF-34AE-4C4B-899A-0C114093F18F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{6534B34D-8D9D-4FD5-8243-D850B1301A6A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{0014F327-77C4-410F-B503-C0EE1A98128D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{F5E10FBA-9FFE-40A6-9748-4E15BAA0B235}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [TCP Query User{78EBCDE1-06B4-49A3-9CE4-460A1C9EBCE1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{312E7875-7410-40E2-A996-5892C596D2D1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{43FF6593-4E26-42DA-8D41-C265630F4EE6}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{B71851F8-4C88-44A3-9727-1569678021E0}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{04CEAA9D-C4CE-4EAA-94B4-80AD6040B8EF}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{BD96691E-F3FF-4475-9EB0-0EC9D657B660}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

==================== Faulty Device Manager Devices =============

Name: Qualcomm Atheros AR9485-Funknetzwerkadapter
Description: Qualcomm Atheros AR9485-Funknetzwerkadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/28/2015 06:22:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x178
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/28/2015 06:07:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x2ac
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/28/2015 05:58:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x294
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2
Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0xb94
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2
Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5

Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2
Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0x4ec
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2
Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5

Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x298
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.


System errors:
=============
Error: (05/28/2015 06:22:33 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/28/2015 06:22:29 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/28/2015 06:07:21 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/28/2015 06:07:17 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/28/2015 06:06:20 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: 
%%1056

Error: (05/28/2015 06:05:50 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/28/2015 06:05:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/28/2015 06:05:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/28/2015 06:05:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/28/2015 06:05:49 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "WindowsMangerProtect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office:
=========================
Error: (05/28/2015 06:22:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb817801d099627ff0f5a2C:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exebe4b8dc6-0555-11e5-8294-d0509942e1d9

Error: (05/28/2015 06:07:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb82ac01d09960605e7115C:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe9eb44480-0553-11e5-8293-d0509942e1d9

Error: (05/28/2015 05:58:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb829401d0995f1fb073f2C:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe5dfcbdfd-0552-11e5-8292-d0509942e1d9

Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f2b9401d0994c6ea4f553C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dllac52d525-053f-11e5-8291-d0509942e1d9

Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f24ec01d0994c67446510C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dlla4f53663-053f-11e5-8291-d0509942e1d9

Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert

Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb829801d09943c85890f5C:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe06a27806-0537-11e5-8291-d0509942e1d9

Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe


CodeIntegrity Errors:
===================================
  Date: 2015-05-28 15:26:09.740
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-27 19:15:22.546
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-26 14:45:18.011
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-25 14:17:25.800
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-24 13:54:52.200
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-23 15:26:44.317
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-22 14:44:37.500
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-20 10:40:37.550
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-19 18:24:36.091
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-18 18:25:52.835
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4460 CPU @ 3.20GHz
Percentage of memory in use: 16%
Total physical RAM: 8127.11 MB
Available physical RAM: 6784.12 MB
Total Pagefile: 16319.11 MB
Available Pagefile: 14647.41 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.13 GB) (Free:86.24 GB) NTFS
Drive e: (USB-STICK) (Removable) (Total:0.95 GB) (Free:0.92 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 37832B8A)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 972 MB) (Disk ID: 000DAD2F)
Partition 1: (Active) - (Size=972 MB) - (Type=0B)

==================== End of log ============================

MFG
Scree

deeprybka · 28.05.2015, 17:40

Addition.txt fehlt

Scree · 28.05.2015, 17:46

Entschuldige, copy paste fehler ^^"
Hab es oben reineditiert.

deeprybka · 28.05.2015, 17:58

Schaut schon gut aus.

Schritt 1

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Scree · 28.05.2015, 18:39

Hier das log:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b8fa6d639562a141bc5778b0091502ce
# engine=24068
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-28 05:32:41
# local_time=2015-05-28 07:32:41 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 7930 9916753 0 0
# scanned=219098
# found=23
# cleaned=0
# scan_time=1489
sh=624584C57A68C425EB7627C1F11660A6ACBBB896 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\shopperz\Firefox\{5081D2D4-1637-404c-B74F-50526718257D}.xpi.vir"
sh=A21F86B669CA8091500448105116EF5A17BA3B34 ft=1 fh=c71c0011a9187f22 vn="Variante von Win32/ELEX.BH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"
sh=791D60098944FE34EC571898D2205F79EDA463E3 ft=1 fh=fa3a7592b017b9dc vn="Variante von Win32/ELEX.DQ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\update\update.exe.vir"
sh=C597F6FE09F0C18DE060A49AA3D35DEA8077283E ft=1 fh=157cb5962d13da52 vn="Variante von Win32/Adware.ConvertAd.AO Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Chris\AppData\Local\03000200-1424777340-0500-0006-000700080009\onsh82A9.tmp.vir"
sh=A7F1770D5E63AF06B930F34213525D4B9A72F247 ft=1 fh=9b80cafb70ceed57 vn="Variante von Win32/Adware.AdService.AO Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Chris\AppData\Local\03000200-1424777340-0500-0006-000700080009\snsh82A7.tmp.vir"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Chris\AppData\Roaming\MIETPOSV.vir"
sh=858524ED0C62DA7FEE38A551865CCDE45A41C289 ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\sweetsearch@gmail.com\chrome\content\toolbar.js.vir"
sh=4CF9EF4D739C2F8A1F3909A2720274527EC29E1F ft=1 fh=c71c001143f2d9bd vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Chris\AppData\Roaming\mystartsearch\UninstallManager.exe.vir"
sh=23E903CC7B693A8A8F2027E6FF9C8C853F2A2902 ft=1 fh=a967996d3991117d vn="Variante von Win32/SpeedBit.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\awhA5EF.tmp"
sh=1B7AAD2D638A41599B4BA323D837DBD0354E77C8 ft=1 fh=ac3aca71d1b38f49 vn="Variante von Win32/InstallCore.PL evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\ICReinstall_nsnABCB.tmp"
sh=4274C0F443F2DEF7BEC50DD68EC9C68068BC2599 ft=1 fh=9210967ce8e51905 vn="Variante von Win32/Adware.ConvertAd.QH Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\nsb33B4.tmp"
sh=1B7AAD2D638A41599B4BA323D837DBD0354E77C8 ft=1 fh=ac3aca71d1b38f49 vn="Variante von Win32/InstallCore.PL evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\nsnABCB.tmp"
sh=FB5D3C024D8252E2BB2E98DD6DD5D487BEDF5D44 ft=1 fh=9e70f47c3a7b9e39 vn="Win32/VOPackage.BV evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\nsnD40F.tmp"
sh=47B19AB97028D8925579BED54EFEE88C8107D6B6 ft=1 fh=34f71966959b3eb8 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\DMR\dmr_72.exe"
sh=1FCF1B7F847B1BF53853C7DEAEAE175CCC232219 ft=1 fh=afa3d958839187c1 vn="Variante von Win32/ELEX.DS evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\stA2A5.tmp\eInstall\eInstall.exe"
sh=7186A8F05DF34ED8B39CAA78CC73712A649FEA37 ft=1 fh=c71c001150204e61 vn="Variante von Win32/ELEX.DS evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\stA2A5.tmp\omigazip\eUninstall.exe"
sh=1A34042AC2035878B5ACBBE6D8FC7C268CBDF560 ft=1 fh=a04a7234dec62c72 vn="Variante von Win32/ELEX.BR evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\stA2A5.tmp\omigazip\TrayDownloader.exe"
sh=2646C43777F777FD8EE89D8674DBD198C2E000B0 ft=1 fh=afc27b2d0dc54a23 vn="Variante von Win32/ELEX.CK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Local\Temp\stA2A5.tmp\omigazip\winzipersvc.exe"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\AppData\Roaming\SUS"
sh=B7C6E0F56BE7EDD9076521CA26BFF3F48FD79C3C ft=1 fh=d8ec1538bce57627 vn="Win32/Adware.ConvertAd.AR Anwendung" ac=I fn="C:\Users\Chris\AppData\Roaming\03000200-1424777293-0500-0006-000700080009\jnswEAD.tmp"
sh=A435D408FAEA2F247FCADB280832EEDCE895D6F2 ft=1 fh=c4417187e42720cd vn="Variante von Win32/Adware.ConvertAd.BM Anwendung" ac=I fn="C:\Users\Chris\AppData\Roaming\03000200-1424777293-0500-0006-000700080009\nsnE034.tmpfs"
sh=C4A4881A4CCE35298243D18884EB80BCD0D0E50B ft=1 fh=1332ccd9c2e0c92d vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung" ac=I fn="C:\Users\Chris\AppData\Roaming\03000200-1424777293-0500-0006-000700080009\vnsiC67B.tmp"
sh=89AE5236FA1A443BAC8341CCE541C73C0FBB1EE8 ft=1 fh=e12b4b122468911e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Chris\Downloads\Paint NET - CHIP-Installer.exe"

deeprybka · 28.05.2015, 18:52

Finger weg vom chipinstaller.
CHIP-Installer - was ist das? - Anleitungen

Schritt 1

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

ATTFilter

CloseProcesses:
C:\Users\Chris\AppData\Roaming\SUS
C:\Users\Chris\AppData\Roaming\03000200-1424777293-0500-0006-000700080009\
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF NetworkProxy: 
EmptyTemp:

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Poste mir bitte deren Inhalt.

Nach dem Reboot:

Schritt 2

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Scree · 28.05.2015, 19:10

Und die nächsten logs:
Fixlog.txt

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01
Ran by Chris at 2015-05-28 19:59:14 Run:1
Running from C:\Users\Chris\Desktop
Loaded Profiles: Chris (Available Profiles: Chris)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
C:\Users\Chris\AppData\Roaming\SUS
C:\Users\Chris\AppData\Roaming\03000200-1424777293-0500-0006-000700080009\
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF NetworkProxy: 
EmptyTemp:
*****************

Processes closed successfully.
C:\Users\Chris\AppData\Roaming\SUS => Moved successfully.
C:\Users\Chris\AppData\Roaming\03000200-1424777293-0500-0006-000700080009 => Moved successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value Removed successfully
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value Removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value Removed successfully
Firefox DefaultSearchEngine Removed successfully
Firefox SelectedSearchEngine Removed successfully
Firefox Proxy settings were reset.
EmptyTemp: => Removed 779.3 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 19:59:16 ====

FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01
Ran by Chris (administrator) on TOWER-POWER on 28-05-2015 20:03:18
Running from C:\Users\Chris\Desktop
Loaded Profiles: Chris (Available Profiles: Chris)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\livecomm.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Dropbox, Inc.) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Gaming Mouse\Gaming Mouse.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2015-01-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Gaming Mouse] => C:\Gaming Mouse\Gaming Mouse.exe [1306624 2009-09-30] ()
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888896 2015-03-24] (Valve Corporation)
Startup: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-01-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-17] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-17] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 213.211.192.34 8.8.8.8
Tcpip\..\Interfaces\{2D5FC48A-55F6-4052-ABDF-159A06A20D32}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-16] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-16] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Extension: Firebug - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\firebug@software.joehewitt.com.xpi [2015-03-05]
FF Extension: Stealthy - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\stealthyextension@gmail.com.xpi [2015-01-17]
FF Extension: Video DownloadHelper - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-26]
FF Extension: Adblock Edge - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-01-13]
StartMenuInternet: FIREFOX.EXE - firefox.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2015-01-17] (Realtek Semiconductor)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [656664 2014-08-19] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2014-11-21] (Advanced Micro Devices)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-06-21] (Advanced Micro Devices)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-15] (Disc Soft Ltd)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [457496 2015-01-14] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 20:03 - 2015-05-28 20:03 - 00000000 ____D () C:\Users\Chris\Desktop\oldlogs2
2015-05-28 19:03 - 2015-05-28 19:03 - 02347384 _____ (ESET) C:\Users\Chris\Desktop\esetsmartinstaller_deu.exe
2015-05-28 18:09 - 2015-05-28 18:23 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-28 18:09 - 2015-05-28 18:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-28 18:09 - 2015-05-28 18:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-28 18:09 - 2015-05-28 18:09 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-28 18:09 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-28 18:09 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-28 18:09 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-28 18:04 - 2015-05-28 18:05 - 00000000 ____D () C:\AdwCleaner
2015-05-28 18:03 - 2015-05-28 18:02 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Chris\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-28 18:03 - 2015-05-28 18:01 - 02222592 _____ () C:\Users\Chris\Desktop\AdwCleaner_4.205.exe
2015-05-28 17:09 - 2015-05-28 20:03 - 00012165 _____ () C:\Users\Chris\Desktop\FRST.txt
2015-05-28 17:08 - 2015-05-28 20:03 - 00000000 ____D () C:\FRST
2015-05-28 17:07 - 2015-05-28 17:07 - 00000168 _____ () C:\Users\Chris\defogger_reenable
2015-05-28 17:06 - 2015-05-28 17:04 - 02108928 _____ (Farbar) C:\Users\Chris\Desktop\FRST64.exe
2015-05-28 17:06 - 2015-05-28 17:04 - 00380416 _____ () C:\Users\Chris\Desktop\q3c7d44r.exe
2015-05-28 17:06 - 2015-05-28 17:03 - 00050477 _____ () C:\Users\Chris\Desktop\Defogger.exe
2015-05-21 19:40 - 2015-05-21 19:40 - 00000000 ____D () C:\Users\Chris\Documents\eBooks
2015-05-21 19:39 - 2015-05-21 19:39 - 00000000 ____D () C:\Users\Chris\Documents\Neuer Ordner
2015-05-21 19:37 - 2015-05-21 19:38 - 70217728 _____ () C:\Users\Chris\Downloads\calibre-64bit-2.28.0.msi
2015-05-20 23:14 - 2015-05-20 23:36 - 154430818 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal Akt 22 Erwartungen - Nemesis - - Niconic.mp4
2015-05-20 23:13 - 2015-05-20 23:18 - 74414621 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal 21.mp4
2015-05-16 14:05 - 2015-05-16 14:05 - 00279816 _____ () C:\Windows\Minidump\051615-4156-01.dmp
2015-05-16 13:43 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-14 13:21 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:21 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:19 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-14 13:19 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-14 13:19 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-14 13:19 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-14 13:19 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-05-14 13:19 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-14 13:19 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-14 13:19 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-14 13:19 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-14 13:17 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-14 13:17 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-14 13:17 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-14 13:17 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-14 13:17 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-14 13:17 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-14 13:17 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-14 13:17 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-14 13:17 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-14 13:17 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-14 13:17 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-14 13:17 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-14 13:17 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-05-14 13:17 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-14 13:17 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-14 13:17 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-14 13:17 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-14 13:17 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-14 13:17 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-14 13:17 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-14 13:17 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-14 13:17 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-14 13:17 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-14 13:17 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-14 13:17 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2015-05-14 13:17 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2015-05-14 13:17 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2015-05-14 13:17 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2015-05-14 13:17 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-14 13:17 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-14 13:17 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-14 13:17 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-14 13:17 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-14 13:17 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:29 - 00410017 _____ () C:\Windows\system32\ApnDatabase.xml
2015-05-14 13:17 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-14 13:17 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-14 13:17 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-14 13:17 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-14 13:17 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-14 13:17 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-14 13:17 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-05 18:27 - 2015-05-05 18:27 - 00014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel
2015-05-04 16:19 - 2015-05-04 16:19 - 00001310 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mcedit2.lnk
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Python-Eggs
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Program Files\mcedit2-win64-2.0.0alpha-232
2015-05-04 15:22 - 2015-05-04 15:23 - 29551850 _____ (Igor Pavlov) C:\Users\Chris\Downloads\mcedit2-win64-2.0.0alpha-232.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 20:00 - 2015-01-16 19:56 - 00000000 ____D () C:\Users\Chris\OneDrive
2015-05-28 20:00 - 2015-01-13 19:18 - 00000000 ___RD () C:\Users\Chris\Dropbox
2015-05-28 20:00 - 2015-01-13 19:14 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Dropbox
2015-05-28 20:00 - 2015-01-13 18:39 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Raptr
2015-05-28 20:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-28 19:59 - 2015-01-13 16:51 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2015-05-28 19:59 - 2014-09-23 23:06 - 00052726 _____ () C:\Windows\PFRO.log
2015-05-28 19:59 - 2013-08-22 16:46 - 00703133 _____ () C:\Windows\setupact.log
2015-05-28 19:59 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-28 19:56 - 2015-01-13 22:00 - 01108379 _____ () C:\Windows\WindowsUpdate.log
2015-05-28 19:11 - 2015-02-09 14:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-28 18:41 - 2015-01-13 22:19 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2561094446-920685720-2640435214-1001
2015-05-28 18:26 - 2014-09-24 08:16 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-28 18:26 - 2014-09-24 07:43 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2015-05-28 18:26 - 2014-09-24 07:43 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2015-05-28 18:07 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-28 17:07 - 2015-01-13 22:00 - 00000000 ____D () C:\Users\Chris
2015-05-28 15:44 - 2015-04-02 15:11 - 00000000 ____D () C:\Users\Chris\AppData\Local\CrashDumps
2015-05-28 15:44 - 2015-01-13 22:00 - 00001764 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-28 15:44 - 2015-01-13 17:28 - 00001485 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-26 17:27 - 2015-04-27 14:42 - 00000000 ____D () C:\Users\Chris\Desktop\Ordner
2015-05-26 17:25 - 2015-01-13 19:51 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Guild Wars 2
2015-05-21 19:47 - 2015-01-29 17:14 - 00000000 ____D () C:\Users\Chris\Documents\Calibre-Bibliothek
2015-05-21 19:40 - 2015-01-15 16:18 - 00000000 ____D () C:\Users\Chris\Sonstiges
2015-05-21 17:50 - 2015-01-18 21:27 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\vlc
2015-05-21 16:02 - 2015-01-13 18:52 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-20 22:03 - 2015-01-26 15:12 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\TS3Client
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 17:40 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-19 15:40 - 2015-01-13 18:39 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-05-17 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2015-05-17 12:48 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-17 11:26 - 2015-01-17 22:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 14:05 - 2015-02-08 04:32 - 504073285 _____ () C:\Windows\MEMORY.DMP
2015-05-16 14:05 - 2015-02-08 04:32 - 00000000 ____D () C:\Windows\Minidump
2015-05-16 11:10 - 2015-01-14 13:41 - 00000000 ____D () C:\Users\Chris\AppData\Local\Adobe
2015-05-16 11:09 - 2015-02-09 14:20 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-15 18:18 - 2013-08-22 16:44 - 00410048 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 23:42 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-05-14 23:42 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 13:22 - 2015-01-15 17:37 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-14 13:21 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 17:27 - 2015-01-13 17:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 17:26 - 2015-01-13 17:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-09 13:03 - 2015-01-13 19:16 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 18:48 - 2015-01-25 13:57 - 00000000 ____D () C:\Users\Chris\Documents\Guild Wars 2
2015-05-05 19:59 - 2014-09-24 09:43 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-05 19:59 - 2014-09-24 09:43 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 18:43 - 2015-01-14 00:05 - 00000000 ____D () C:\Users\Chris\.gimp-2.8
2015-05-05 18:27 - 2015-01-16 02:25 - 00000000 ____D () C:\Users\Chris\AppData\Local\gtk-2.0
2015-04-29 18:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF

==================== Files in the root of some directories =======

2015-01-20 23:54 - 2015-01-20 23:54 - 0003584 _____ () C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-05-05 18:27 - 2015-05-05 18:27 - 0014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel

Some files in TEMP:
====================
C:\Users\Chris\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppc4djx.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-27 19:15

==================== End of log ============================

Das mit dem Chip downloader habe ich an meine Freundin weitergereicht. Der muss sich vor längerer Zeit mal eingeschlichen haben. Ist der auch für den aktuellen Fall verantwortlich oder nur ein Zusatzfund?

MFG
Scree

deeprybka · 28.05.2015, 19:13

Nur ein Zusatzfund.

Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Scree · 28.05.2015, 19:21

Wenn Firefox neu gestartet wird, erscheint immernoch delta-homes. wenn man den home button drückt erscheint jedoch die normale firefox such seite. Neue Tabs sehen auch wieder normal aus (Lesezeichenkacheln).
Kann man irgendwie herausfinden wodurch sich dieser blödsinn installiert hat?

MFG
Scree

deeprybka · 28.05.2015, 19:28

Zitat:

Zitat von Scree

Kann man irgendwie herausfinden wodurch sich dieser blödsinn installiert hat?

Kann man bestimmt, ist aber irrelevant.

Wenn der Firefox gestartet wird, erscheint delta homes?

Scree · 28.05.2015, 19:34

Irrelevant würde ich jetzt nicht sagen. Man kann es in Zukunft ja nur vermeiden, wenn man weis was man falsch gemacht hat. Aber gut.

Zitat:

Wenn der Firefox gestartet wird, erscheint delta homes?

Ja, bei einem frischen Start von Firefox wird immer delta-homes.com aufgerufen. Ich finde mich in den neuen Firefox Optionen grad auch nicht zurecht, wo ich die Startseite änder kann.

Edit:
Unter Einstellungen Allgemein steht bei
Wenn Firefox gestartet wird: Startseite anzeigen
und bei
Startseite: Mozilla-Firefox-Startseite
trotzdem startet er mit delta-homes...

deeprybka · 28.05.2015, 19:46

Zitat:

Zitat von Scree

Irrelevant würde ich jetzt nicht sagen. Man kann es in Zukunft ja nur vermeiden, wenn man weis was man falsch gemacht hat. Aber gut.

Jeder User bekommt am Ende der Bereinigung Tipps mit auf den Weg, wie er sich besser schützen kann. Reicht Dir das nicht?

Code:

ATTFilter

2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\WinZipper

Zu dieser Zeit ist das Zeug erstellt worden.
Ein vernünftiger Virenscanner hilft sowas zu vermeiden.

Schritt 1

Bitte starte FRST erneut, markiere auch die checkbox

und drücke auf Scan.
Bitte poste mir den Inhalt von "Shortcut.txt".

Scree · 28.05.2015, 20:09

Hier die shortcut.txt

Code:

ATTFilter

Users shortcut scan result (x64) Version: 27-05-2015 01
Ran by Chris at 2015-05-28 20:48:16
Running from C:\Users\Chris\Desktop
Boot Mode: Normal
==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)



Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk -> C:\Windows\Installer\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}\SC_Reader.ico (Flexera Software LLC)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Camera.lnk -> C:\Windows\Camera\Camera.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileManager.lnk -> C:\Windows\FileManager\FileManager.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk -> C:\Program Files\GIMP 2\bin\gimp-2.8.exe (Spencer Kimball, Peter Mattis and the GIMP Development Team)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Immersive Control Panel.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inkscape.lnk -> C:\Program Files (x86)\Inkscape\inkscape.exe (inkscape.org)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotosApp.lnk -> C:\Windows\FileManager\PhotosApp.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Store.lnk -> C:\Windows\WinStore\WinStore.htm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom\Wacom Voreinstellungen.lnk -> C:\Program Files\Tablet\Pen\Consumer_CPL.exe (Wacom Technology, Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom\Wacom Voreinstellungsdatei-Dienstprogramm.lnk -> C:\Program Files\Tablet\Pen\32\PrefUtil.exe (Wacom Technology, Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client\TeamSpeak 3 Client.lnk -> C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe (TeamSpeak Systems GmbH)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client\Uninstall.lnk -> C:\Program Files\TeamSpeak 3 Client\Uninstall.exe (TeamSpeak Systems GmbH)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows Easy Transfer.lnk -> C:\Windows\System32\migwiz\migwiz.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++\Notepad++.lnk -> C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPaint\MyPaint.lnk -> C:\Program Files\MyPaint\mypaint.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPaint\Uninstall MyPaint.lnk -> C:\Program Files\MyPaint\uninstall.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Miranda IM\Miranda IM.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Excel 2010.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft OneNote 2010.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft PowerPoint 2010.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010-Tools\Digitales Zertifikat für VBA-Projekte.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010-Tools\Microsoft Clip Organizer.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010-Tools\Microsoft Office 2010 Upload Center.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010-Tools\Microsoft Office 2010-Spracheinstellungen.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 2010-Tools\Microsoft Office Picture Manager.lnk -> C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Malwarebytes Anti-Malware entfernen.lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Malwarebytes Anti-Malware Notifications.lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \ Malwarebytes Anti-Malware .lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware \Tools\Malwarebytes Anti-Malware Chameleon.lnk -> C:\Program Files (x86)\ Malwarebytes Anti-Malware \Chameleon\Windows\chameleon.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Java konfigurieren.lnk -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\javacpl.exe (Oracle Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haskell Platform 2014.2.0.0\GHC Documentation.lnk -> C:\Program Files\Haskell Platform\2014.2.0.0\doc\html\index.html ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haskell Platform 2014.2.0.0\GHC Flag Reference.lnk -> C:\Program Files\Haskell Platform\2014.2.0.0\doc\html\users_guide\flag-reference.html ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haskell Platform 2014.2.0.0\GHCi.lnk -> C:\Program Files\Haskell Platform\2014.2.0.0\bin\ghci.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haskell Platform 2014.2.0.0\Library Documentation.lnk -> C:\Program Files\Haskell Platform\2014.2.0.0\lib\extralibs\doc\frames.html ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haskell Platform 2014.2.0.0\WinGHCi.lnk -> C:\Program Files\Haskell Platform\2014.2.0.0\winghci\winghci.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Guild Wars 2\Guild Wars 2.lnk -> C:\Program Files (x86)\Guild Wars 2\Gw2.exe (ArenaNet)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Mouse\Gaming Mouse.lnk -> C:\Gaming Mouse\Gaming Mouse.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Mouse\Manual.lnk -> C:\Gaming Mouse\manual\index.html ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Mouse\Uninstall.lnk -> C:\Gaming Mouse\uninstall.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Mouse\Upgrade Tool.lnk -> C:\Gaming Mouse\upgrade_tool.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\FileZilla.lnk -> C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe (FileZilla Project)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client\Uninstall.lnk -> C:\Program Files (x86)\FileZilla FTP Client\uninstall.exe (Tim Kosse)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\Oblivion.lnk -> C:\Program Files (x86)\Oblivion\OblivionLauncher.exe (Bethesda Softworks)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\Readme.lnk -> C:\Program Files (x86)\Oblivion\Readme.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved\AMD Gaming Evolved.lnk -> C:\Program Files (x86)\Raptr\raptrstub.exe (Raptr, Inc)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center\AMD Catalyst Control Center.lnk -> C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk -> C:\Windows\System32\comexp.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk -> C:\Windows\System32\dfrgui.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk -> C:\Windows\System32\cleanmgr.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk -> C:\Windows\System32\iscsicpl.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk -> C:\Windows\System32\MdSched.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk -> C:\Windows\SysWOW64\odbcad32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk -> C:\Windows\System32\odbcad32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk -> C:\Windows\System32\printmanagement.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk -> C:\Windows\System32\services.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk -> C:\Windows\System32\msconfig.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk -> C:\Windows\System32\msinfo32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk -> C:\Windows\System32\WF.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell ISE (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell ISE.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk -> C:\Windows\System32\calc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk -> C:\Windows\System32\mspaint.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk -> C:\Windows\System32\mstsc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk -> C:\Windows\System32\SnippingTool.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk -> C:\Windows\System32\SoundRecorder.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk -> C:\Windows\System32\psr.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk -> C:\Windows\System32\StikyNot.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Fax and Scan.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk -> C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\XPS Viewer.lnk -> C:\Windows\System32\xpsrchvw.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk -> C:\Program Files\Windows Journal\Journal.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk -> C:\Windows\System32\charmap.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{C51411C0-11DB-AD74-0008-BDAB669A0C20}\PlayTasks\0\Play.lnk -> C:\Program Files (x86)\Guild Wars 2\Gw2.exe (ArenaNet)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{47BDA9E1-58AB-49C5-956B-82137E273EFC}\PlayTasks\0\Launch.lnk -> C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe (Bethesda Softworks)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{3B750E39-4554-C691-1D4D-C7B033A15E0D}\PlayTasks\0\Play.lnk -> C:\Program Files (x86)\GUILD WARS\Gw.exe (ArenaNet)
Shortcut: C:\Users\Chris\Music\Music (TARTAROS) - Verknüpfung.lnk -> \\TARTAROS\Music ()
Shortcut: C:\Users\Chris\Music\Musik - Verknüpfung.lnk -> \\TARTAROS\home\Musik ()
Shortcut: C:\Users\Chris\Links\Chris.lnk -> C:\Users\Chris ()
Shortcut: C:\Users\Chris\Links\Desktop.lnk -> C:\Users\Chris\Desktop ()
Shortcut: C:\Users\Chris\Links\Downloads.lnk -> C:\Users\Chris\Downloads ()
Shortcut: C:\Users\Chris\Links\Dropbox.lnk -> C:\Users\Chris\Dropbox ()
Shortcut: C:\Users\Chris\Links\eigene Kiseki Homepage.lnk -> C:\Users\Chris\Documents\eigene Kiseki Homepage ()
Shortcut: C:\Users\Chris\Links\home (TARTAROS).lnk -> \\TARTAROS\home ()
Shortcut: C:\Users\Chris\Links\htdocs.lnk -> C:\Users\Chris\Documents\Kiseki Homepage\kiseki-musical\htdocs ()
Shortcut: C:\Users\Chris\Links\Uni.lnk -> C:\Users\Chris\Uni ()
Shortcut: C:\Users\Chris\Desktop\Ordner\Acrobat Reader DC.lnk -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe (Adobe Systems Incorporated)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\calibre.lnk -> C:\Program Files\Calibre2\calibre.exe ()
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk -> C:\Users\Chris\Documents ()
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DTLite.lnk -> C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (Disc Soft Ltd)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\i_view32.lnk -> C:\Program Files (x86)\IrfanView\i_view32.exe (Irfan Skiljan)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mcedit2.lnk -> C:\Program Files\mcedit2-win64-2.0.0alpha-232\mcedit2.exe ()
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft.lnk -> C:\Program Files (x86)\Minecraft\Minecraft.exe (Mojang)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Musik.lnk -> C:\Users\Chris\Music ()
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Oblivion.lnk -> C:\Program Files (x86)\Oblivion\Oblivion.exe (Bethesda Softworks)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk -> C:\Users\Chris\Pictures ()
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vlc.lnk -> C:\Program Files\VideoLAN\VLC\vlc.exe (VideoLAN)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinCal.lnk -> C:\Program Files (x86)\WinCal\WinCal.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Windows.Defender.lnk -> C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Uninstall Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxUninstaller.exe (Dropbox, Inc.)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\SendTo\Dropbox.lnk -> C:\Users\Chris\Dropbox ()
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\i_view32.lnk -> C:\Program Files (x86)\IrfanView\i_view32.exe (Irfan Skiljan)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Miranda IM.lnk -> C:\Program Files (x86)\Miranda IM\miranda32.exe (Miranda IM)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Notepad++.lnk -> C:\Program Files (x86)\Notepad++\notepad++.exe (Don HO don.h@free.fr)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TeamSpeak 3 Client.lnk -> C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe (TeamSpeak Systems GmbH)
Shortcut: C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WinCal.lnk -> C:\Program Files (x86)\WinCal\WinCal.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk -> C:\Windows\System32\compmgmt.msc ()
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk -> C:\Windows\System32\diskmgmt.msc ()
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk -> C:\Windows\System32\eventvwr.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation)
Shortcut: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk -> C:\Users\Chris\Documents ()
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk -> C:\Users\Chris\Pictures ()
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Windows.Defender.lnk -> C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk -> C:\Windows\System32\compmgmt.msc ()
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk -> C:\Windows\System32\diskmgmt.msc ()
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk -> C:\Windows\System32\eventvwr.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation)


ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
ShortcutWithArgument: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
ShortcutWithArgument: C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
ShortcutWithArgument: C:\Users\Chris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499


ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> -sta {C90FB8CA-3295-4462-A721-2935E83694BA}
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Default Programs.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DefaultPrograms
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk -> C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) -> /7
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Auf Updates prüfen.lnk -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\javacpl.exe (Oracle Corporation) -> -tab update
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Info zu Java.lnk -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\javacpl.exe (Oracle Corporation) -> -tab about
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Embedded Lockdown Manager\Embedded Lockdown Manager.lnk -> C:\Windows\System32\mmc.exe (Microsoft Corporation) -> "%windir%\system32\EmbeddedLockdown.msc"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\Uninstall Oblivion.lnk -> C:\Program Files (x86)\InstallShield Installation Information\{C66BF9FD-D367-4E13-8EB8-385FFEA20DB3}\setup.exe (Macrovision Corporation) -> /M{35CB6715-41F8-4F99-8881-6FC75BF054B0}
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center\Hilfe.lnk -> C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CLI.exe (ATI Technologies Inc.) -> Start Help -help
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk -> C:\Windows\System32\compmgmt.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Embedded Lockdown Manager.lnk -> C:\Windows\System32\mmc.exe (Microsoft Corporation) -> "%windir%\system32\EmbeddedLockdown.msc"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk -> C:\Windows\System32\eventvwr.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk -> C:\Windows\System32\perfmon.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk -> C:\Windows\System32\perfmon.exe (Microsoft Corporation) -> /res
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk -> C:\Windows\System32\secpol.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Speech Recognition.lnk -> C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) -> -SpeechUX
ShortcutWithArgument: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) -> /systemstartup
ShortcutWithArgument: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) -> /home
ShortcutWithArgument: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - Network Connections.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> ::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DeviceManager
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\06 - System.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.System
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\08 - Power Options.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.PowerOptions
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group3\10 - Programs and Features.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.ProgramsAndFeatures
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f8-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> /e,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk -> C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) -> /0
ShortcutWithArgument: C:\Users\Chris\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{3080F90D-D7AD-11D9-BD98-0000947B0257}
ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - Network Connections.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> ::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DeviceManager
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\06 - System.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.System
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\08 - Power Options.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.PowerOptions
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\10 - Programs and Features.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.ProgramsAndFeatures
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f8-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> /e,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk -> C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) -> /0
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{3080F90D-D7AD-11D9-BD98-0000947B0257}


InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam Support Center.url -> hxxp://support.steampowered.com/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haskell Platform 2014.2.0.0\HackageDB - Haskell Software Repository.url -> hxxp://hackage.haskell.org
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Guild Wars 2\Guild Wars 2 Support Webseite.url -> hxxp://support.guildwars2.com/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Guild Wars 2\Guild Wars 2 Webseite.url -> hxxp://www.guildwars2.com/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks\Oblivion\ElderScrolls.com.url -> hxxp://www.elderscrolls.com/
InternetURL: C:\Users\Chris\Favorites\Bing.url -> hxxp://go.microsoft.com/fwlink/p/?LinkId=255142
InternetURL: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Miranda IM\Donate.url -> hxxp://www.miranda-im.org/donate/
InternetURL: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox Website.URL -> hxxp://www.dropbox.com

==================== End of log =============================

Edit:

Zitat:

Zu dieser Zeit ist das Zeug erstellt worden.
Ein vernünftiger Virenscanner hilft sowas zu vermeiden.

Das ist es ja, was mich stutzig macht. Zu der Zeit war keiner am PC, nicht mal im Zimmer. Also muss es sich ja von selber installiert haben.

28.05.2015, 17:40	#4
deeprybka /// TB-Ausbilder /// Anleitungs-Guru	Winzipper und delta homes Addition.txt fehlt __________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

28.05.2015, 19:13	#10
deeprybka /// TB-Ausbilder /// Anleitungs-Guru	Winzipper und delta homes Nur ein Zusatzfund. Gibt es jetzt noch Probleme mit dem PC? Wenn ja, welche? __________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer

Winzipper und delta homes

Log-Analyse und Auswertung: Winzipper und delta homes